What is a Certificate Signing Request (CSR)?

A certificate signing request (CSR) is a PEM file that's  kind of similar to an X.509 certificate, but it only contains the basic information that the Certificate Authority (CA) needs to sign a certificate for the client: subject names, the public key, requested extensions, and a signature. A CSR is signed using the private key. To get a signed certificate, first the client generates a private key, public key, and CSR. It sends the CSR to the CA along with whatever the CA needs to authenticate the request. If everything checks out, the CA sends back a certificate—and the client can delete the CSR, since it's no longer needed.