Knowledge Base

Knowledge Base Certificate Signing Request (CSR)

How to generate a code signing CSR using the Windows certreq command

Updated on August 21, 2026

Overview

By the end of this article you will have generated a Certificate Signing Request (CSR) for a Code Signing Certificate on a Windows computer and be ready to submit it to Sectigo. The article explains the key length requirement set by the Certificate Authority/Browser Forum (CA/Browser Forum), lists the prerequisites, then covers the two-part procedure: creating a request.inf file that holds the subject details, and running the certreq command to produce the CSR file. It also explains how to verify the CSR was created, what to do with the certificate once Sectigo issues it, and answers to frequently asked questions.

Key length requirement

Since June 1, 2021, the Certificate Authority/Browser Forum (CA/Browser Forum) Code-signing Baseline Requirements state that the bit length of an RSA (Rivest–Shamir–Adleman) key must be 3072 or greater. Sectigo recommends generating the Certificate Signing Request (CSR) with a 4096-bit key. The configuration in this article uses 4096 bits.

What is request.inf?

A request.inf file is a plain text configuration file that tells the Windows certreq command what to include in a Certificate Signing Request (CSR) — the subject details, key length, hash algorithm, and intended certificate use. You create the file in a text editor such as Notepad, then pass it to certreq to produce the CSR.

Prerequisites

A Windows computer where the Code Signing Certificate will later be installed
A text editor such as Notepad
Permission to run commands at the Windows command prompt i.e. admin access to manage certlm
Your organization's subject details: common name, organization name, locality, state or province, and two-letter country code

Generate the Certificate Signing Request (CSR) on the computer where you intend to install the certificate. The private key is created on that machine and cannot be moved by exporting the CSR alone.

Steps to generate the CSR

Step 1 — Create the request.inf file

Open a text editor such as Notepad and copy the configuration below into a new file. Change only the Subject line to your own company details, then save the file as request.inf.

[NewRequest]
;Change to your country code(C), common name(CN), company name(O), locality(L), state/province name (S)
Subject = "CN=Your Company Name, O=Your Company Name, L=City, S=State, C=US"
KeySpec = 1
KeyLength = 4096
Exportable = TRUE
MachineKeySet = FALSE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
HashAlgorithm = SHA256

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.3 ; this is for code signing

The subject values map as follows: CN is the common name, O is the organization name, L is the locality or city, S is the state or province, and C is the two-letter country code. The OID (Object Identifier) value 1.3.6.1.5.5.7.3.3 marks the request as a code signing request — do not change it.

When saving in Notepad, set Save as type to All Files so the file is saved as request.inf and not request.inf.txt.

Step 2 — Run the certreq command

Open the Windows command prompt, change to the folder containing request.inf, and run:

CERTREQ -new request.inf codesign.csr

The command generates the Certificate Signing Request (CSR) and saves it as codesign.csr in the same folder. The matching private key is created in the Windows certificate store on that computer.

Step 3 — Submit the CSR to Sectigo

Open codesign.csr in a text editor and copy the full contents, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines. Submit the request to Sectigo through your account to order the Code Signing Certificate.

How to verify the CSR was created successfully

The Certificate Signing Request (CSR) was created successfully when all of the following are true:

The codesign.csr file exists in the folder where you ran the command.
Opening the file in a text editor shows a text block beginning with -----BEGIN CERTIFICATE REQUEST----- and ending with -----END CERTIFICATE REQUEST-----.
The certreq command returned no error at the command prompt.

After the certificate is issued

Install the certificate on the same computer that generated the Certificate Signing Request (CSR), because that computer holds the private key. Run:

certreq -accept certificate.crt

You can then export the certificate as a PFX (Personal Information Exchange) file for backup or for use on a signing workstation.

Troubleshooting

Issue: certreq reports that the .inf file cannot be found or is invalid.

Cause: The file was saved as request.inf.txt by the text editor, or the command was run from a different folder.

Solution: In Notepad, select Save as type › All Files and save the file as request.inf. Change to the folder holding the file before running the command.

Issue: Sectigo rejects the submitted Certificate Signing Request (CSR).

Cause: The copied text is incomplete — usually the -----BEGIN CERTIFICATE REQUEST----- or -----END CERTIFICATE REQUEST----- line is missing — or the key length is below the required 3072 bits.

Solution: Copy the full contents of codesign.csr including both boundary lines. Confirm KeyLength = 4096 in request.inf and regenerate the request if it was changed.

Tips and best practices

Keep a copy of request.inf so future requests for the same organization can reuse the subject details.
Do not change the OID value in the EnhancedKeyUsageExtension section — it is what identifies the request as code signing.
Record which computer generated the request. That machine holds the private key and must be used to install the issued certificate.

Frequently asked questions

What is a CSR?
A Certificate Signing Request (CSR) is an encoded block of text containing the subject details and public key that a Certificate Authority uses to issue a certificate. For code signing, it is generated on the computer that will hold the private key.

What key length is required for a Code Signing Certificate?
The Certificate Authority/Browser Forum (CA/Browser Forum) Code-signing Baseline Requirements require an RSA key of 3072 bits or greater as of June 1, 2021. Sectigo recommends 4096 bits.

Can I generate the CSR on one computer and install the certificate on another?
No. The private key is created on the computer that runs the certreq command, so the issued certificate must be installed on that same computer. You can export it as a PFX file afterwards and move it.

Where is the CSR file saved?
The command CERTREQ -new request.inf codesign.csr saves the Certificate Signing Request (CSR) as codesign.csr in the folder where the command was run.

How do I install the certificate once Sectigo issues it?
Run certreq -accept certificate.crt on the same computer that generated the request.