in public key infrastructure (pki) systems, a certificate signing request (also csr or certification request) is a message sent from an applicant to a certificate authority in order to apply for a digital identity certificate. the most common format for csrs is the pkcs #10 specification and another is the signed public key and challenge spkac format generated by some web browsers. == procedure == before creating a csr, the applicant first generates a key pair, keeping the private key secret. the csr contains information identifying the applicant (such as a distinguished name in the case of an x.509 certificate) which must be signed using the applicant's private key. the csr also contains the public key chosen by the applicant. the csr may be accompanied by other credentials or proofs of identity required by the certificate authority, and the certificate authority may contact the applicant for further information. typical information required in a csr:: {| class="wikitable" |- ! information ! description |- | distinguished name (dn) | this is fully qualified domain name that you wish to secure e.g. 'www.example.comâ or 'mail.example.com'. this includes the common name (cn) e.g. 'www' or 'mail' |- | business name / organization | usually the legal incorporated name of a company and should include any suffixes such as ltd., inc., or corp. |- | department name / organizational unit | e.g. hr, finance, it |- | town/city | e.g. london, waterford, paris, new york, dhaka,kochi |- | province, region, county or state | this should not be abbreviated e.g. sussex, normandy, new jersey |- | country | the two-letter iso code for the country where your organization is located e.g. gb, fr or us etc.. |- | an email address | an email address to contact the organization. usually the email address of the certificate administrator or it department |} if the request is successful, the certificate authority will send back an identity certificate that has been digitally signed with the private key of the certificate authority. == structure == the three main parts that a certification request consists of are the certification request information, a signature algorithm identifier, and a digital signature on the certification request information. the first part contains the significant information, including the public key. the signature by the requester prevents an entity from requesting a bogus certificate of someone else's public key. thus the private key is needed to produce, but it is not part of, the csr.{{cite web |url=http://www.gnutls.org/manual/htm
Cryptographic_protocols