How it works
Complete the job in three clear steps
- Enter the certificate subject and choose the key algorithm.
- Generate and cryptographically verify the result locally.
- Download the generated PEM files, then protect the unencrypted private key.
Private Web Crypto certificate tool
Certificate Signing Request Generator
Generate a signed PKCS#10 CSR with requested DNS SANs plus its new SPKI public and unencrypted PKCS#8 private PEM keys.
Free to use The key pair is generated in this browser with Web Crypto and is never sent to Lucaden. Results are not retained by this tool.
Loading tool workspace…
Important
Check the result before relying on it
Scan-test generated codes before printing or distribution. A generated barcode does not register identifier ownership, and decoded external links should be checked before opening.
Practical details
What this Lucaden tool does
Generate a signed PKCS#10 CSR with requested DNS SANs plus its new SPKI public and unencrypted PKCS#8 private PEM keys.
The workspace exports standards-based PEM output, proof-checks the generated signature, and never persists the unencrypted private key.
Included capabilities
- ECDSA or RSA keys
- Distinguished-name fields
- DNS SAN extension request
- Verified PKCS#10 signature
Useful for
- Request a development certificate
- Prepare an internal CA request
- Test CSR handling
- Create a local TLS fixture
Questions
About this tool
Does Lucaden receive or save the private key?
No. Web Crypto creates and exports it in this browser. This workspace does not upload it or put it in local storage.
Is the downloaded private key encrypted?
No. It is an unencrypted PKCS#8 PEM. Store it only in an access-controlled secret manager or encrypt it with an appropriate offline workflow.
Open-source foundations
Built transparently
Lucaden documents its standards sources, architectural references, and permissive runtime dependencies while keeping this workspace consistent with the Lucaden interface.