There could be various reasons for encountering an “Invalid CSR” error.
How to fix ‘CSR invalid’ errors
Here are the main points you need to pay attention to when generating a CSR:
Step 1
You should be using an FQDN (Fully Qualified Domain Name) as a Common name (in some control panels it can also be called Host name or Domain name) -e..g. domain.com or anything.domain.com. The hostname should be listed without http:// at the beginning. This should not be an intranet hostname (something.local) or an IP address. Local hostnames and IP addresses require a specific type of certificates that we do not have available at the moment.
Step 2
Characters in the CSR should be alphanumeric, no special characters should be used [! @ # $ % ^ ( ) ~ ? > < & / \ , . ” ‘ _] If you are using a password for your CSR/RSA pair, please make sure there are no special characters in the password as well.
Step 3
Country code should be a valid ISO 3166-1 two-letter code (e.g. US, AU, CA). If you are located in the United Kingdom, your country code will be «GB» instead of «UK». The country code should be listed as two capital letters.
Step 4
Make sure you have included the header and footer of the CSR into the enrollment form. The header and footer will look like:
—–BEGIN CERTIFICATE REQUEST—–encoded data—–END CERTIFICATE REQUEST—–
Step 5
There have to be 5 dashes on each side of Begin and End certificate request. There should also be no trailing spaces in the CSR.
Step 6
Your CSR code length should be at least 2048-bit.
Step 7
You should have no SAN (Subject Alternative Names) within your CSR code if you are using a non-UCC certificate.
Step 8
In most cases during CSR generation you also receive an RSA Private key (starts with —–BEGIN RSA PRIVATE KEY—–). You don’t need to include it into the CSR field. The RSA Private key should be saved, as it is required during SSL installation.
Step 9
Before pasting CSR into the field paste it into a simple text editor (notepad, textedit) to make sure formatting is correct.
Step 10
If you are renewing your certificate, your common name has to be the same as the original one – the domain should not be changed. Though, for certificates reissuance, it is possible to use another domain name or another subdomain to have the certificate reissued for it.