What does CSR stand for?
CSR stands for Certificate Signing Request. The request sent to a certificate authority to obtain a certificate. It contains the public key and identity details and is signed with the matching private key, which never leaves the requester.
A CSR is the file sent to a certificate authority to ask for a certificate. The applicant first generates a key pair. The CSR contains the public key and the identity to be certified, such as a server name, and is signed with the matching private key to prove the applicant holds it. The authority checks the request and returns a signed certificate. The private key is never part of the CSR and should not leave the system where it was created.
CSR in practice: an example
An administrator needs a certificate for a new intranet site. On the web server she generates a key pair and a CSR containing the site's name, and submits the CSR to the company's certificate authority. The authority returns the certificate, which she installs next to the private key that stayed on the server the whole time.
What CSR is confused with
CSR vs certificate: what is the difference?
The CSR is the application; the certificate is the result. A CSR is signed by the applicant's own key, a certificate by the authority's key.
CSR vs private key: what is the difference?
The CSR carries the public key only. Sending the private key to anyone, including the certificate authority, defeats the purpose of the key pair.
Which exams cover CSR?
CSR is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: 1.3 (General Security Concepts).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which item is included in a certificate signing request?
- The applicant's private key
- The applicant's public key
- The certificate authority's private key
- The revocation list
Show the answer
B. The applicant's public key. The request carries the public key and the identity. The private key stays with the applicant and is used only to sign the request.
2. A technician is about to email a server's private key to the certificate authority together with the CSR. What should he be told?
- That is the normal process
- Only the CSR is sent; the private key must stay on the server
- The private key must be sent first
- The CSR must be deleted before sending
Show the answer
B. Only the CSR is sent; the private key must stay on the server. The authority needs only the public key in the CSR. A private key that has been emailed must be considered exposed.
Sources: RFC 2986: PKCS #10: Certification Request Syntax Specification; NIST glossary: certificate signing request. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.