Compare
CSR vs CRT
A CSR is a certificate signing request submitted for issuance. CRT is an extension commonly used for an issued certificate; their roles differ before and after issuance.
Which format should you choose?
Use a CSR during the application step; deploy the issued certificate in the format required by the destination.
Good fit for CSR
Request a certificate
- Submitting a new certificate request to a CA
Good fit for CRT
Transfer or deploy X.509 certificates
- Servers and clients requesting certificate files
Basic information
| Field | CSR | CRT |
|---|---|---|
| Extension | .csr | .crt, .cer |
| MIME type | application/pkcs10 | application/pkix-cert |
| Common uses | Request a certificate | Transfer or deploy X.509 certificates |
| How to open | Inspect subject and requested domain names with a certificate tool before submission. | Use a certificate viewer to inspect subject names, issuer, validity dates, and chain. |
| Export or convert | A certificate is issued through a CA process; renaming a CSR does not convert it into a certificate. | Before converting, determine encoding, whether the file includes a chain, and whether a private key is stored separately. |
Choose by use case
Submitting a new certificate request to a CA
Request a certificate
CSRServers and clients requesting certificate files
Transfer or deploy X.509 certificates
CRTKey point 1
A CSR contains a public key and request information.
More on the differencesKey point 2
CRT commonly labels an issued certificate file.
More on the differencesMore on the differences
Verify the issued certificate, chain, and target encoding before deployment. Keep the associated private key secure and separate from the CSR and certificate.
- A CSR is not itself a deployed server certificate.
- A CRT file may use PEM or DER encoding.
- The target service determines the needed chain and file format.
Frequently asked questions
Can I deploy a CSR instead of the certificate?
No. A CSR requests issuance; deploy the certificate returned after issuance.