---
type: concept
title: Certificate Signing Request (CSR)
tags: ["pki", "security", "certificates", "csr", "openssl"]
related: [serverzertifikate, openssl, iis]
created: 2026-06-30
updated: 2026-06-30
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_dfn_pki_zertifikate_serverzertifikate_har.md", "output/rz_uni_greifswald_de_dienste_allgemein_dfn_pki_zertifikate_serverzertifikate_mic.md", "output/rz_uni_greifswald_de_dienste_allgemein_dfn_pki_zertifikate_serverzertifikate_ope.md"]
---

# Certificate Signing Request (CSR)

A **Certificate Signing Request (CSR)** is a block of encoded text or an encoded file (typically `.pem`) that an applicant sends to a Certificate Authority (CA) to apply for a digital certificate. It contains information about the entity requesting the certificate and the public key that will be included in the certificate.

## Implementation Methods
Depending on the environment, different tools are used to generate the CSR:

### Microsoft IIS Method
In Windows environments (e.g., [[windows-server-2022]]), the **IIS Manager** is used. The process involves:
- Navigating to **Server Certificates** $\rightarrow$ **Create Certificate Request**.
- Filling in identity parameters (Country, State, City, Organization).
- Saving the output as a `.txt` file.
- **Constraint**: Umlauts are not permitted in the request fields (e.g., "Universitaet" instead of "Universität").

### OpenSSL Method
Alternatively, [[openssl]] can be used to generate private keys and CSRs in a platform-independent manner.

## Usage at Universität Greifswald

### Requirements for CSR Generation
When generating a CSR for university services via [[openssl]], the following identity parameters are mandatory:

| Parameter | Required Value |
|---|---|
| Country | DE |
| State/Province | Mecklenburg-Vorpommern |
| Locality | Greifswald |
| Organization | `Universitaet Greifswald` |
| Common Name | The DNS name of the server |
| Email | Applicant's email address |

**Note:** The spelling of the organization as "Universitaet Greifswald" is critical for the request to be accepted.

### Process via HARICA
In the context of obtaining [[serverzertifikate]] via the [[harica]] system:
- The CSR is generated locally using tools such as [[openssl]] or [[iis]].
- The CSR is uploaded manually to the HARICA Certificate Manager using the "Submit CSR manually" function.
- **Important**: The HARICA system ignores DNS information embedded within the CSR; domain names must be specified separately in the HARICA manager interface.