Knowledge Base

Knowledge Base Certificate Signing Request (CSR)

How to Generate a Certificate Signing Request (CSR) in pfSense

Updated on August 14, 2026

Overview

By the end of this article, you will have created a Certificate Signing Request (CSR) and its matching private key in pfSense, exported the CSR text, and submitted it to Sectigo for signing. A CSR is an encoded request that contains your certificate details and public key, which a Certificate Authority (CA) uses to issue a signed SSL/TLS using the built-in Certificate Manager so you can request a signed SSL/TLS certificate from an external Certificate Authority (CA).

This procedure is based on pfSense version 2.8.1-RELEASE (amd64).

Prerequisites

Administrator access to the pfSense WebGUI
A running pfSense firewall version 2.8.1-RELEASE or later
A fully qualified domain name (FQDN) or hostname for the certificate
Access to an external Certificate Authority (CA) such as Sectigo

Steps to Generate a CSR in pfSense

Step 1: Sign in to the pfSense WebGUI

Figure 1: pfSense WebGUI login page displaying the administrator sign-in screen with Username and Password fields for accessing the firewall management interface.

Step 2: Open the Certificate Manager

Navigate to:

System → Certificates

The Certificate Manager is used to create, manage, and export certificates and CSRs in pfSense.

Figure 2: pfSense navigation menu showing the System → Certificates path used to access the Certificate Manager for creating, managing, and exporting certificates and Certificate Signing Requests (CSRs).

Step 3: Add a New Certificate Entry

Open the Certificates tab.
Select + Add/Sign.
From the Method dropdown, select Create a Certificate Signing Request.

This action generates:

A private key
A Certificate Signing Request (CSR)

Figure 3:Certificates page in the pfSense Certificate Manager showing existing certificate entries and the + Add/Sign button used to create or sign a new certificate or Certificate Signing Request (CSR).

Step 4: Complete the Certificate Details

Field	Description
Descriptive Name	A meaningful label such as pfSense-HTTPS
Key Length	2048 or 4096 bits
Digest Algorithm	SHA256 or another supported Secure Hash Algorithm
Common Name (CN)	The hostname or FQDN used to access pfSense (for example: fw.example.com)
Country, State, City, Organization, Email	Optional organizational details
Subject Alternative Name (SAN)	Additional hostnames to include in the certificate

Figure 4: Certificate creation screen in pfSense with the Create a Certificate Signing Request option selected from the Method dropdown, preparing the system to generate a new CSR and private key.

Step 5: Save the Request

Select Save. pfSense generates the CSR and stores the matching private key locally on the firewall.

Figure 5: Certificate request form in pfSense showing the Save button used to generate and store a new Certificate Signing Request (CSR) and its associated private key.

Step 6: Export the CSR

Navigate to System → Certificates → Certificates.
Locate the certificate request you created.
Select the Export CSR icon.

pfSense exports the CSR text, which can then be submitted to your Certificate Authority.

Figure 6: Certificates list in the pfSense Certificate Manager showing a newly created certificate signing request and the Export CSR icon used to download the CSR for submission to a Certificate Authority such as Sectigo.