Generate, view and delete a CSR in cPanel for a paid SSL certificate

A Certificate Signing Request (CSR) is the text block you send to a certificate authority (Sectigo, DigiCert and others) when you buy an SSL certificate. cPanel creates the CSR together with a private key, which stays on the server and is needed later to install the certificate. You only need this for paid certificates such as OV, EV or wildcard; normal domain SSL is free and automatic with AutoSSL.

Before you start

• Access to cPanel.
• The exact hostname the certificate is for, for example example.com, www.example.com or *.example.com for a wildcard.
• Your organisation details as registered, if you are buying an OV or EV certificate.

Generate a CSR

1. Open cPanel → Security → SSL/TLS.
2. Under Certificate Signing Requests (CSR), click Generate, view, or delete SSL certificate signing requests.
3. In Key, leave Generate a new 2,048-bit key (or choose an RSA 4,096-bit or ECDSA key if your certificate authority asks).
4. In Domains, enter each hostname on its own line. Put the main name first, for example example.com then www.example.com.
5. Fill in City, State (written out, not abbreviated), Country, Company and Email. Use your legal company name for OV/EV; for DV use your name.
6. Leave Passphrase empty; most certificate authorities do not need it.
7. Click Generate.

cPanel shows the Encoded Certificate Signing Request. Copy everything from -----BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST----- and paste it into the certificate authority's order form.

Retrieve a CSR later

1. Open cPanel → Security → SSL/TLS → Certificate Signing Requests.
2. Under Certificate Signing Requests on Server, click Edit next to the domain.
3. Copy the encoded CSR again. The matching private key is listed under Private Keys (KEY).

Install the certificate

When the certificate authority sends the certificate (a .crt file plus a CA bundle), install it in SSL/TLS → Manage SSL sites. cPanel finds the matching private key automatically. Full steps: install an SSL certificate in cPanel.

Delete old CSRs

1. In Certificate Signing Requests on Server, click Delete next to the CSR you no longer need.
2. Confirm with Delete CSR.

Deleting a CSR does not affect an installed certificate. Unused private keys can be removed in SSL/TLS → Private Keys once you are sure no certificate uses them.

Troubleshooting

• The certificate authority rejects the CSR: check that you copied the full block including the BEGIN and END lines, and that the country is a two-letter code.
• Wrong hostname on the certificate: the first domain in the CSR becomes the common name; create a new CSR with the right order and reissue.
• Certificate does not match a key on install: the CSR was generated on another server; generate a new one here and reissue.

Next steps

• Install an SSL certificate in cPanel
• Include or exclude domains from AutoSSL
• Force HTTPS for your site