Why Your CSR Got Rejected (And How to Fix It)

Rejection: Key Size Too Small

Why it happens: You're using an old key, old documentation, or legacy scripts that specify outdated key sizes. RSA-1024 was deprecated years ago but still appears in legacy configs.

The fix:

# Generate proper RSA key
openssl genrsa -out private.key 3072

# Or generate ECC key (smaller, faster)
openssl ecparam -name prime256v1 -genkey -noout -out private.key

Check your existing key:

openssl rsa -in private.key -text -noout | grep "Private-Key"
# Should show: Private-Key: (2048 bit) or higher

Rejection: Weak Key Detected

CAs maintain databases of known-weak keys and will reject CSRs using them.

Sources of weak keys:

The fix: Generate a new key. There's no way to "strengthen" a weak key.

# Always generate fresh keys on a properly configured system
openssl genrsa -out private.key 3072

# Verify entropy source is working (Linux)
cat /proc/sys/kernel/random/entropy_avail
# Should be > 256

For more on secure key generation, see our OpenSSL Key Generation Guide.

Rejection: Key Previously Compromised

If your private key has ever been:

• • Posted publicly (GitHub, Pastebin, etc.)
• • Submitted to certificate transparency logs by mistake
• • Part of a breach disclosure
• • Reported to the CA as compromised

...the CA will reject any CSR using that key.

How CAs detect this:

• • Monitoring CT logs for private key submissions
• • Databases of known-compromised keys (from breaches)
• • Cross-referencing with previous revocation requests

The fix: Generate a completely new key pair. Never reuse a compromised key.

Rejection: Domain Validation Failed

The CA couldn't verify you control the domain(s) in your CSR.

Common causes:

• • DNS not propagated yet
• • HTTP challenge file not accessible
• • Email going to wrong address
• • CAA record blocking the CA

The fix: This isn't a CSR problem - it's a validation problem. See the Domain Validation Methods Guide.

Rejection: Internal/Non-Public Domain Names

CAs cannot issue publicly-trusted certificates for:

The fix:

• • Use a real domain you own and create subdomains
• • Use a private CA for internal systems
• • Consider split-horizon DNS

For internal systems, see our Self-Signed Certificates Guide.

Rejection: IP Address Issues

IP addresses in certificates have specific requirements.

The fix: If you need certificates for private IPs, use a private CA. Public CAs can only issue for public IPs they can validate.

Rejection: Wildcard Restrictions

Wildcards have specific rules that cause rejections.

The fix: Restructure your SAN list to comply with wildcard rules.

For more on wildcard risks, see our Wildcard Certificate Dangers Guide.

Rejection: Invalid PEM Encoding

PEM format requires:

• • Header: -----BEGIN CERTIFICATE REQUEST-----
• • Base64-encoded content (64 characters per line)
• • Footer: -----END CERTIFICATE REQUEST-----

Common corruption causes:

• • Copying from terminal added line breaks
• • Email client wrapped lines
• • Windows CRLF vs Unix LF issues
• • Editor added invisible characters (BOM)

The fix:

# Verify CSR format is valid
openssl req -in request.csr -text -noout

# If it fails, check for encoding issues
file request.csr
# Should show: "PEM certificate request"

# Convert if needed (DER to PEM)
openssl req -in request.der -inform DER -out request.pem -outform PEM

Rejection: Mismatched Key and CSR

The CSR wasn't signed by the private key you're trying to use.

How this happens:

• • Generated new key but used old CSR
• • Copied wrong file
• • Key file overwritten between generation and CSR creation

The fix:

# Verify CSR and key match
openssl req -in request.csr -noout -pubkey > csr_pubkey.pem
openssl rsa -in private.key -pubout > key_pubkey.pem
diff csr_pubkey.pem key_pubkey.pem
# Should show no differences

If they don't match, generate a new CSR with the correct key:

openssl req -new -key private.key -out request.csr

Rejection: Rate Limited

You've requested too many certificates in a time window.

Let's Encrypt Limits:

The fix: Wait for the rate limit to reset, or use staging environment for testing.

# Use Let's Encrypt staging for testing
certbot certonly --staging -d example.com

Rejection: High-Risk Domain

Some CAs flag certain domains for additional review or outright rejection:

• • Domains containing brand names (apple, google, microsoft)
• • Domains similar to financial institutions (phishy-looking finance domains like "secure-banklogin.com" often trigger extra review)
• • Previously-phished domains
• • Domains on blocklists

The fix: Contact CA support for manual review. Be prepared to explain the legitimate purpose of your domain and provide additional verification if requested. Alternatively, choose a different CA.

Rejection: Organization Validation Failed (OV/EV)

For OV and EV certificates, the CA couldn't verify your organization.

Common causes:

• • Organization name doesn't match business registry exactly
• • Address doesn't match official records
• • Phone number can't be verified
• • Organization too new (some CAs require operating history)

The fix: Ensure CSR organization details match exactly what's in public business registries (state filings, Dun & Bradstreet, etc.).