AutoCSR

The AutoCSR service generates a Certificate Signing Request (CSR) and Private Key for you when you order an SSL Certificate without supplying your own. It lets you complete an order and receive a working SSL Certificate without handling the technical side of Certificate Signing Request (CSR) generation yourself.

It suits customers who are not familiar with server administration, who use hosting with limited access, or who simply prefer a quicker checkout.

Tip : For production environments, generate your own Certificate Signing Request (CSR) on your server. The Private Key is then created where your SSL Certificate will be installed and never leaves it, which is the most secure approach.

AutoCSR is best kept for development environments, testing, or cases where generating a Certificate Signing Request (CSR) on the server is not practical.

What Is AutoCSR

When you place an SSL Certificate order without a Certificate Signing Request (CSR), Trustico® generates one for you. A Certificate Signing Request (CSR) is normally created on your web server and holds the Public Key that will be embedded in your SSL Certificate, along with identifying details about your domain name and organization.

The Certificate Authority (CA) uses those details during validation. If you are unsure how to create a Certificate Signing Request (CSR), or would rather Trustico® handled it, enter a Fully Qualified Domain Name (FQDN) when ordering and AutoCSR takes care of the rest.

The service generates a 2048-bit RSA key pair that meets Certificate Authority (CA) requirements. Learn About Certificate Signing Request (CSR) Generation 🔗

How AutoCSR Works

Once you place your order, AutoCSR handles each stage automatically, from generating your credentials to delivering your Private Key and issuing your SSL Certificate.

Placing Your Order

During ordering, a dropdown lets you choose how to supply your details. You can provide your own Certificate Signing Request (CSR), or enter a Fully Qualified Domain Name (FQDN) instead.

Choosing to enter a Fully Qualified Domain Name (FQDN) activates the free AutoCSR service, and Trustico® generates the Certificate Signing Request (CSR) and Private Key for you. AutoCSR is included with every Trustico® SSL Certificate order at no additional fee.

Credential Generation

Trustico® creates a 2048-bit RSA key pair from the details you entered at checkout. This produces a Private Key and a matching Public Key, and the Public Key is embedded in the Certificate Signing Request (CSR).

Key generation uses cryptographically secure random number generation, so each key pair is unique. Learn About RSA Encryption Algorithms 🔗

Receiving Your Private Key

Your Private Key is delivered in an encrypted archive, protected with AES-256 encryption so it stays secure in transit. The archive contains only your Private Key.

Your SSL Certificate is never bundled with your Private Key, because delivering both together would be a security risk.

Retrieving Your Unlock Code

The code that opens the encrypted archive is held separately, in your order details within your account. Even if the archive is intercepted, it cannot be opened without access to your Trustico® account. View Our AutoCSR File Unlock Code Instructions 🔗

Important : The unlock code is generally available for seven days only from when your order is processed. Obtain your Private Key and all installation files as soon as you are notified that they are available.

Once your SSL Certificate has been validated and issued, the unlock code can also be retrieved from the download page of the Trustico® tracking system, where it remains available for seven days in the same way as within the ordering system.

Order Submission and Validation

Once the Certificate Signing Request (CSR) is generated, your request is submitted to the Certificate Authority (CA). Validation then follows the type of SSL Certificate you bought, whether Domain Validation (DV), Organization Validation (OV), or Extended Validation (EV).

Complete any verification steps promptly so your SSL Certificate is issued without delay. Discover The Validation Procedure 🔗

Receiving Your SSL Certificate

After validation, your SSL Certificate and any Intermediate Certificates are available to download from the Trustico® tracking system. You then combine your Private Key from the archive with the issued SSL Certificate when you install it on your server. Explore Our Tracking System 🔗

Two-Channel Security Delivery

AutoCSR keeps the encrypted archive and the unlock code apart, so reaching your Private Key means having access to two separate systems. This is the same way hosting companies generate credentials for their customers, with one important difference : Trustico® does not retain your Private Key at any time.

Important : Once your encrypted Private Key archive has been generated and delivered, no copy remains on any Trustico® system. You alone hold your Private Key.

The archive is delivered as a ZIP file containing only your Private Key, protected with AES-256 encryption. The unlock code is stored in your order details on the Trustico® website, so a compromised account on its own still cannot expose your Private Key.

Opening the Encrypted Archive

The archive uses AES-256 encryption, which some operating systems cannot open without extra software. Detailed steps are on the unlock code page.

Unlock Code Instructions

The sections below cover extraction on each operating system.

Windows Operating Systems

The built-in Windows extraction tool does not support AES-256 encrypted archives, so install 7-Zip or WinRAR, both free. Right-click the archive, choose the extraction option, and enter your unlock code when prompted. The extracted file is your Private Key, which you use with your SSL Certificate during installation.

Mac Operating Systems

On macOS you can usually double-click the archive and enter the unlock code. Some versions of macOS do not fully support AES-256 encrypted ZIP files through the built-in Archive Utility, in which case install The Unarchiver, free from the Mac App Store.

Linux Operating Systems

Most Linux distributions handle AES-256 ZIP extraction through the file manager or the command-line 7z utility, using 7z x filename.zip and your unlock code. If the tools are not present, install the p7zip package through your distribution's package manager.

Important Security Information

The file you receive holds the Private Key needed to install and operate your SSL Certificate.

Warning : Protect your Private Key carefully. Anyone who has it could impersonate your website or decrypt traffic meant for your server.

Store your Private Key somewhere with restricted access, and do not share it with anyone who does not administer your server.

If You Lose Your Credentials

Trustico® does not keep a copy of your Private Key after delivery, so it exists only where you put it and cannot be exposed by a breach of our systems.

If you lose the Private Key or delete the archive, reissue your SSL Certificate. A reissue generates a new key pair and SSL Certificate to replace the originals. Explore Reissuing Your SSL Certificate 🔗

Private Key Protection

Never share your Private Key, store it somewhere public, or send it over an unencrypted connection. When you install your SSL Certificate, set file permissions so only the accounts that need it can read the Private Key.

Most web servers expect read access limited to the root user or the web server process. Weak permissions can undermine the protection your SSL Certificate provides.

When to Provide Your Own Certificate Signing Request

For production environments, generating your own Certificate Signing Request (CSR) on your server is the better choice, because your Private Key is created where the SSL Certificate will run and never leaves it.

Generate your own Certificate Signing Request (CSR) if your hosting provider or IT team requires the Private Key to be created on the server, if your security policy mandates particular key-generation methods, or if you use a Hardware Security Module (HSM), which must generate the Certificate Signing Request (CSR) itself.

If you already have a Certificate Signing Request (CSR), choose the option to provide it during ordering and AutoCSR stays off. Your own Certificate Signing Request (CSR) is then used, and you receive only the issued SSL Certificate and Intermediate Certificates, with no Private Key package. Learn About How to Generate a Certificate Signing Request (CSR) 🔗

Trustico® also offers a free online tool to create a Certificate Signing Request (CSR) if you would rather not use your server.

Certificate Signing Request Generator

The tool produces both a Certificate Signing Request (CSR) and a Private Key for you to download immediately.

Installation Assistance

If you need help installing your SSL Certificate after receiving your AutoCSR credentials, Trustico® provides installation guidance and a professional installation service. The steps vary by server software, but AutoCSR credentials work with all standard configurations. Discover SSL Certificate Installation Instructions 🔗

If you would rather not install it yourself, the Premium Installation service has our technicians configure the SSL Certificate on your server for you. It suits complex environments or anyone who wants the work done by an expert. View Our Premium Installation Service 🔗

Getting Help

If you have questions about AutoCSR or your SSL Certificate order, our support team can help. Explore Trustico® Support Resources 🔗

Most Popular Questions

Frequently asked questions covering the AutoCSR service, activating it at checkout, how your Private Key and unlock code are delivered, opening the encrypted archive, and when to generate your own Certificate Signing Request

The AutoCSR Service Explained

AutoCSR generates a Certificate Signing Request (CSR) and Private Key on your behalf when you order an SSL Certificate without supplying your own. It uses a 2048-bit RSA key pair that meets Certificate Authority (CA) requirements. The service is included at no extra cost with every Trustico® SSL Certificate order.

Activating AutoCSR at Checkout

During ordering, a dropdown lets you provide your own Certificate Signing Request (CSR) or enter a Fully Qualified Domain Name (FQDN) instead. Entering a Fully Qualified Domain Name (FQDN) activates the free AutoCSR service, and Trustico® generates the Certificate Signing Request (CSR) for you. It is included with every order at no additional fee.

Receiving Your Private Key

Your Private Key is delivered in an encrypted ZIP archive protected with AES-256 encryption. The archive holds only your Private Key, never the SSL Certificate itself, because delivering both together would be a security risk. The unlock code that opens the archive is provided separately.

Accessing Your Unlock Code

The unlock code is shown in your order details within your account, and, once your SSL Certificate has been validated and issued, on the download page of the tracking system. Keeping the code separate from the archive means a compromised account alone cannot expose your Private Key. It is available for seven days in either place.

The Seven-Day Unlock Code Window

The unlock code is generally available for seven days only from when your order is processed. Obtain your Private Key and installation files as soon as you are notified that they are ready. Expired credentials cannot be regenerated, so you would need to reissue your SSL Certificate.

Opening the Encrypted Archive

The archive uses AES-256 encryption, which some systems need extra software to open. On Windows, use 7-Zip or WinRAR; on macOS, The Unarchiver; and on Linux, the p7zip package. Enter your unlock code when prompted to extract the Private Key.

Trustico® and Your Private Key

Trustico® does not retain your Private Key at any time. Once the encrypted archive has been generated and delivered, no copy remains on any Trustico® system, so your Private Key exists only where you store it. If you lose it, you would reissue your SSL Certificate to obtain a new one.

When to Generate Your Own Certificate Signing Request

Generate your own Certificate Signing Request (CSR) on your server for production environments, when your IT team or security policy requires the Private Key to be created on the server, or when you use a Hardware Security Module (HSM). In those cases the Private Key stays within the environment where the SSL Certificate will run.

Using an Existing Certificate Signing Request

If you already have a Certificate Signing Request (CSR), choose the option to provide it during ordering and AutoCSR stays off. Your own request is then used, and you receive only the issued SSL Certificate and any Intermediate Certificates, with no Private Key package.

Protecting Your Private Key

Store your Private Key somewhere with restricted access and never share it with anyone who does not administer your server. When you install the SSL Certificate, limit read access to the accounts that need it, typically the root user or the web server process.