Hack the Route Start free Open app Encryption and trust
Certificate signing request
What a server sends a CA to get a certificate: its public key and names, signed with its private key.
The private key never leaves the server; the CSR's signature proves the requester holds it. The CA checks the names (ACME, as used by Let's Encrypt, does it automatically by a challenge on the domain) and signs a certificate valid for a limited time: at most 200 days for public certificates since March 2026 (47 by 2029), so a stolen key is worth less. A certificate whose key leaks before then is revoked, published in a CRL or answered by OCSP.