CSR and private key generator
Generate a PKCS#10 certificate signing request and matching password-encrypted private key in your browser, or decode an existing CSR locally.
Generation runs locally using this browser's cryptographic API. The private key is encrypted before download; Cloudek does not receive or store the names, key, CSR, or passphrase. Prefer the generated random passphrase; a length check cannot measure strength. Use a trusted device and secure both downloaded files.
Decode an existing CSR
Paste only a PEM certificate request. Parsing stays in this browser; the request is not uploaded or tracked. Never paste a private key. If private-key text is detected, decoding is refused. This informational view does not verify the request signature, identity, certificate policy, or issuance.
Decoded fields will appear here.
Microsoft Learn describes the PKCS #10 request subject as the requester's distinguished name: Subject Names (read 5 November 2026). The decoder is an informational parser; check certificate requests with your organization's approved tools.
The CA issues the certificate; this tool does not submit the request, validate CA policy, install a certificate, create a PFX, or prove ownership of a domain. Keep the encrypted key and passphrase separate. Anyone with both can use the key. Private-key handling is security-sensitive: review the generated request and use your organization's approved key-management process. PKCS #10 specification.