Back to tools

SSL Certificate Command Generator

Answer a few questions about your domain and setup, and get the exact openssl or certbot command to run — CSRs, Certbot issuance, self-signed dev certs, inspection and renewal, all in one place.

Commands only — never a certificate or key.

This page assembles the exact openssl and certbot command line for your situation. It never generates, handles, stores or displays a real private key or certificate in your browser — a page that offered to do that would be exactly the thing to distrust. You copy the command below and run it yourself, on the machine where the key should actually live.

Step 1

Build the CSR command

Generates a private key and a certificate signing request together. You hand the .csr to your CA — the .key never leaves this machine.

Comma-separated.

Result

openssl command

openssl req -new \
  -newkey rsa:2048 \
  -nodes \
  -keyout wespner.eu.key \
  -out wespner.eu.csr \
  -subj '/C=CZ/ST=Prague/L=Prague/O=Wespner s.r.o./CN=wespner.eu' \
  -addext 'subjectAltName=DNS:wespner.eu,DNS:www.wespner.eu'

Flags explained

What each part actually does

-new -newkey …

Creates a brand-new private key together with the request, in one step. -nodes means the key file is left unencrypted (no passphrase) — that's what nginx/Apache expect so they can start without a prompt; keep the file's permissions at 600 instead.

-keyout domain.key

Filename for the newly created private key. This file must never be sent anywhere, including to your CA.

-out domain.csr

Filename for the request itself — this is the file you actually submit to a certificate authority.

-subj "/C=…/O=…/CN=…"

Fills in the certificate's subject fields without an interactive prompt.

-addext "subjectAltName=…"

Lists every hostname the certificate should cover. Modern browsers ignore the CN field entirely for validation and trust only the names listed here — the CN is included as a SAN automatically.

Runs entirely in your browser — nothing is uploaded, and no key or certificate is ever generated here.

Running your own game server?

Wespner game servers with DDoS protection, NVMe drives and activation within minutes.

Browse hosting