Browser-based CSR generator
How to generate a CSR and private key on blackbox.md, field by field, and what to save right away.
On this page
The “Generator CSR — Certificate Signing Request” (CSR generator — Certificate Signing Request) page (blackbox.md/domains/csr, menu “Domenii” (Domains) → “Generator CSR” (CSR generator)) creates a certificate signing request (CSR) and the private key that goes with it. You need both to buy a commercial SSL certificate. Everything runs in your browser: “Toate datele sunt procesate în browser-ul dvs. — cheia privată nu părăsește calculatorul.” (All data is processed in your browser — the private key never leaves your computer.)
Available to: anyone visiting blackbox.md; you don't need an account. Russian version of the page: blackbox.md/ru/domains/csr.
The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.
Note You don't need a CSR for a free Let's Encrypt certificate: certbot creates one on the server by itself. See Web server with HTTPS: nginx or Apache and Let's Encrypt.
How to generate the CSR and key
- Open
https://blackbox.md/domains/csr. The “Generator CSR” (CSR generator) form is below the page title and description. Until it loads, you see “Generatorul se încarcă...” (The generator is loading...) in its place. - Under “Tip cheie” (Key type), choose the option you want (see the table below). “RSA 2048” is selected by default.
- Fill in the fields as shown in the table in the “Form fields” section below.
- Click “Generează CSR și cheia privată” (Generate CSR and private key). While the key is being generated, the button shows “Se generează...” (Generating...). An RSA 4096 key takes longer to generate.
- On the result screen, save the key first: in the “Cheia privată (.key)” (Private key (.key)) block, click “Descarcă” (Download).
- In the “CSR (.csr) — trimiteți la CA” (CSR (.csr) — send to the CA) block, click “Descarcă” or “Copiază” (Copy).
| “Tip cheie” (Key type) | Description on screen | When to choose it |
|---|---|---|
| “RSA 2048” (default) | “Standard universal” (Universal standard) | Maximum compatibility. Choose it if you're not sure. |
| “RSA 4096” | “Securitate maximă” (Maximum security) | Longer key, slower to generate. |
| “ECDSA P-256” | “Modern, mai rapid” (Modern, faster) | New servers. Doesn't work on very old systems and browsers. |
Form fields
| Field | What to enter | Value when the page opens |
|---|---|---|
| “Common Name (CN)” * | The exact domain, without https://. On-screen help: “Domeniul exact pentru certificat. Wildcard: *.domeniu.md” (The exact domain for the certificate. Wildcard: *.domeniu.md) |
empty (example: “www.domeniu.md”) |
| “Țară (ISO 2 litere)” (Country (ISO, 2 letters)) | The 2-letter country code: MD, RO, US. The letters are changed to uppercase automatically. |
MD |
| “Regiune / Județ” (Region / County) | Your region, district or municipality | Chisinau |
| “Localitate” (Locality) | Your city or town | Chisinau |
| “Organizație” (Organization) | The company's legal name | empty (example: “Numele Companiei SRL” (Company Name SRL)) |
| “Departament (OU)” (Department (OU)) | The department, if you want | empty (example: “IT”) |
| “Email contact” (Contact email) | A contact address, if you want | empty (example: “admin@domeniu.md”) |
| “Subject Alternative Names (opțional)” (Subject Alternative Names (optional)) | All the names the certificate covers, one per line or separated by commas. On-screen help: “Un domeniu pe linie. Pentru certificate multi-domain.” (One domain per line. For multi-domain certificates.) | empty |
The “Common Name (CN)” field is required (marked with *). “Țară (ISO 2 litere)” must contain a 2-letter code; the default is MD. The other fields can stay empty, and empty fields are left out of the CSR. “Regiune / Județ” and “Localitate” default to Chisinau: change them if your company is based somewhere else. The gray text in empty fields (“IT”, “Numele Companiei SRL”) is only an example: it isn't included in the CSR unless you type it in. The form doesn't check the email address. For OV and EV certificates, the CA checks the name in “Organizație”, so enter it exactly as it appears in your company's documents.
Tip The CN is not added to the SAN list automatically. In “Subject Alternative Names (opțional)”, enter all the names, including the one in the CN, for example
example.comandwww.example.com. A wildcard*.example.comdoesn't coverexample.com, so add it separately.
Error messages
| Message | Cause | What to do |
|---|---|---|
| “Common Name (CN) este obligatoriu” (Common Name (CN) is required) | The CN field is empty. | Enter the domain. |
| “Country trebuie să fie un cod ISO de 2 litere (ex: MD, RO, US)” (Country must be a 2-letter ISO code (e.g. MD, RO, US)) | “Țară (ISO 2 litere)” (Country (ISO, 2 letters)) is empty or has only one character. | Enter the 2-letter code. |
| “SAN invalid (trebuie nume DNS valide): …” (Invalid SAN (valid DNS names required): …) | The entries shown at the end of the message are not valid domain names. | Enter only complete domain names with their extension (example.com, not domeniu): no http://, no /, no IP addresses. Use a wildcard only as *. at the beginning. |
| “Eroare la generare: …” (Generation error: …) | The browser could not generate the key. | Reload the page or try an up-to-date browser. Alternatively, use openssl (see below). |
The result screen
After generation, the result replaces the form:
| Element | What it contains |
|---|---|
| “Salvați cheia privată ACUM” (Save the private key NOW) | The warning: “Cheia nu poate fi recuperată după ce părăsiți pagina. Descărcați-o sau copiați-o într-un loc sigur.” (The key cannot be recovered after you leave the page. Download it or copy it to a safe place.) |
| “Cheia privată (.key)” (Private key (.key)) | The key in PEM format (PKCS#8), starting with -----BEGIN PRIVATE KEY-----. It is not password-protected. “Descarcă” (Download) saves the file under the CN's name, for example www.example.com.key. |
| “CSR (.csr) — trimiteți la CA” (CSR (.csr) — send to the CA) | The CSR in PEM format, starting with -----BEGIN CERTIFICATE REQUEST-----, signed with SHA-256. “Descarcă” saves, for example, www.example.com.csr. |
| “Generează altul” (Generate another) | Takes you back to the form and keeps the values you entered. The key and CSR shown on screen disappear. |
After you click “Copiază” (Copy), the button shows “Copiat!” (Copied!) for 2 seconds. If the label doesn't change, the browser has blocked access to the clipboard: use “Descarcă” or select the text with your mouse. With a wildcard CN, the file name contains “*”, and the browser may replace it with another character; rename the file if needed.
Warning The private key exists only on this page. If you close the tab, reload the page or click “Generează altul” before saving it, the key is lost, and the CSR made with it can no longer be used. BLACKBOX doesn't have a copy.
What to do with the files
- The CSR (
.csr) goes to the CA you're buying the certificate from. A commercial certificate through BLACKBOX is ordered on request, through support; see SSL certificates: free (Let's Encrypt) and commercial. Before you send it, you can check it with the steps in Checking a CSR or certificate with openssl. - The key (
.key) stays with you and goes only onto the server where you install the certificate (see Transferring files to the server (scp, rsync, SFTP)). Don't send it to anyone: not to the CA, not to support, not by email.
The openssl option, directly on the server
You can generate the same files on the server: connect over SSH (Connecting to your server over SSH (Windows, macOS, Linux)) and run the command below. The key stays on the server, so you don't need to copy it there. The result is the same as with the generator: an RSA 2048 key without a password in PEM format (PKCS#8) and a CSR signed with SHA-256, with the names in the SAN. Replace DOMAIN with your domain (for example example.com) and COMPANY_NAME with your company's name. Use only Latin letters in the values, without diacritics.
openssl req -new -newkey rsa:2048 -nodes -sha256 -keyout DOMAIN.key -out DOMAIN.csr -subj "/C=MD/ST=Chisinau/L=Chisinau/O=COMPANY_NAME/CN=www.DOMAIN" -addext "subjectAltName=DNS:DOMAIN,DNS:www.DOMAIN"For RSA 4096, replace rsa:2048 with rsa:4096. For ECDSA P-256:
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes -sha256 -keyout DOMAIN.key -out DOMAIN.csr -subj "/C=MD/ST=Chisinau/L=Chisinau/O=COMPANY_NAME/CN=www.DOMAIN" -addext "subjectAltName=DNS:DOMAIN,DNS:www.DOMAIN"The -addext option requires OpenSSL 1.1.1 or newer. Check your version:
openssl versionThe command also works on your own computer if it has openssl. On Windows, use WSL; in Git Bash, type MSYS_NO_PATHCONV=1 and a space at the beginning of the command, otherwise the -subj value gets changed and the command fails.
Frequently asked questions
I lost the private key. Can you recover it? No. The key is generated only in your browser, and BLACKBOX never receives it. Generate a new pair and use the new CSR. If the certificate has already been issued for the old CSR, ask the CA to reissue it with the new CSR.
Can I make a new CSR for a key I already have? The browser generator always creates a new key. For an existing key, use openssl:
openssl req -new -key DOMAIN.key -out DOMAIN-new.csr -subj "/C=MD/ST=Chisinau/L=Chisinau/O=COMPANY_NAME/CN=www.DOMAIN" -addext "subjectAltName=DNS:DOMAIN,DNS:www.DOMAIN"Even so, when you renew the certificate it's better to generate a new key.
RSA or ECDSA? RSA 2048 is accepted by every browser and server. ECDSA P-256 is more modern and faster, but doesn't work on very old systems. If you're not sure, choose RSA 2048.
Can I check the CSR on the website? No. The decoder page (“CSR Decodor” (CSR decoder) in the menu, or the “Decoder CSR” (CSR decoder) button on the generator page) doesn't decode files. Check the CSR with openssl: Checking a CSR or certificate with openssl.
Does BLACKBOX see the data I enter? No. The key and CSR are generated in the browser, and the page doesn't send them anywhere. The form data is lost when you close the tab.