Issuing certificates from a CSR

Follow the steps below to process a PKCS #10 Certificate Signing Request (CSR) for a locally generated key pair.

To issue a certificate from a CSR:

1. Generate a key pair and a CSR on your local machine using your preferred tools.

2. Follow Accessing your instances to log in to the PKIaaS user interface using an account with one of the following roles:

   • Owners
   • Certificate Administrators

3. Click Certificate Authorities in the sidebar.

   

4. In the Certificate Authorities tab, select the three dots (…) to the right of the certificate authority that will issue the certificate.

5. Select Issue Certificate.

6. Click Certificate with Client-side Generated CSR (X.509 cert).

7. Complete the following values.

   • Certificate profile
   • Certificate Signing Request
   • Use Subject from CSR
   • Subject
   • Subject Alternative Names
   • Custom fields

Certificate profile

Select one of the Subscriber certificate profiles for the certificate authority to issue this certificate.

Certificate Signing Request

Paste the encoded text of a Certificate Signing Request (CSR) you have locally generated for a key pair.

Sectigo note

When issuing from a third-party Sectigo authority, the request form can include additional metadata-driven fields (for example CA configuration fields and custom fields) based on the selected authority configuration.

Use Subject from CSR

Check this box if you want the issued certificate to use the same subject Distinguished Name (DN) as the CSR pasted in the Certificate Signing Request field.

Subject

Enter a value for each RFC 5280 attribute in the certificate subject’s Distinguished Name (DN).

Alternatively, you can:

1. Toggle the Advanced Subject switch.
2. Type a Distinguished Name (DN) that includes additional attributes.

For example, when the certificate subject represents a corporate employee:

CN=John Doe, OU=Sales, O=Example Corp, L=San Francisco, ST=California, C=US

When the certificate subject represents a corporate domain:

CN=server1.example.com, OU=IT, O=Example Corp, L=Chicago, ST=Illinois, C=US

Subject Alternative Names

Add optional Subject Alternative Names (SANs) for the certificate subject. Typically, SANs extend the domain names or IP addresses set in the Subject field of a TLS certificate. For example:

Custom Fields

Enter values for the optional fields described in Managing custom fields.