English

বাংলা
हिन्दी

English

বাংলা
हिन्दी

Appearance

Validation and CSR ​

This guide covers how domain validation works, how to generate a certificate signing request (CSR), and how to keep the private key safe. You will also learn what to do when validation fails.

Before you begin ​

  • The domain name the certificate is for, and access to its DNS or to the email address the validation uses.
  • A computer with openssl installed, if the order asks you to create your own CSR and key.
  • A secure place to store the private key.

Never share the private key

The private key proves that you control the certificate. Anyone who has it can impersonate your site. Never send it by email or chat, never upload it to a public place, and never store it in a web folder.

Steps ​

Validation ​

  1. Open your certificate order in the Client Area and read the validation method it shows.
  2. For DNS validation, add the TXT record the order gives you, using the exact host and value. See TXT records.
  3. For email validation, where offered, open the message sent to the address listed, and follow its link. Check that the link goes to the expected domain.
  4. Wait for the check to complete. DNS checks can take time to see the new record.

Generate a CSR (if the order asks for one)

  1. On your computer, create a new key and CSR with the command below, replacing the domain name:

    bash
    openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr -subj "/CN=yourdomain.com"

  2. Paste the contents of the CSR file (yourdomain.csr) into the order form. Do not paste the key file.

  3. Store the key file (yourdomain.key) in a safe place with restricted access.

Expected result ​

The validation completes, the certificate is issued, and you hold the private key that matches the CSR.

If something goes wrong ​

  • The DNS record is not found. Check the host and value, and wait for the record to spread. Read DNS troubleshooting.
  • Email validation link does not work. Request the message again, and check that the address matches the one on the order.
  • The CSR is rejected. Check the domain name in the CSR and that you pasted the whole CSR, including the begin and end lines.
  • You lost the private key. A certificate cannot be installed without it. Ask support about reissuing the certificate with a new key.

Last reviewed ​

2026-10-27