IconVault's CSR Generator creates a real PKCS#10 Certificate Signing Request plus its 2048-bit RSA private key without leaving your browser. Fill in the subject fields: Common Name (usually your domain), Organization, Organizational Unit, City, State, Country and email. A hand-written DER encoder builds the request and WebCrypto signs it with SHA-256, outputting standard PEM blocks.

The security model is the point: the private key is generated in your browser's memory and never uploaded, so only you ever hold it. Copy or download both files, then send only the CSR to your certificate authority; never share the private key. Free, no account, no OpenSSL needed.