Free tool · 🔏 SSL certificate / CSR command builder
The right opensslcommand, first time.
CSR with SANs, self-signed for labs, or Let’s Encrypt — with the verification commands you run after install.
Private keys never leave your server; this page only builds commands.
What it checks
Everything we would look at first on a client call.
Free, no sign-up, no email gate. If the report shows red, the fix is written next to it — and we are one click away if you would rather we did it.
- openssl config with SAN list
- Key, CSR, self-signed and verification commands
- certbot (nginx/webroot/DNS wildcard) commands
- Post-install check
FAQ
Common questions
RSA or ECDSA?
ECDSA P-256 is smaller and faster; RSA 2048 is the safe default for old clients. Both commands shown.
How long are certificates valid now?
Public certs are moving to shorter lifetimes — automate renewal (certbot/ACME) and monitor expiry with our SSL check.