[{"data":1,"prerenderedAt":341},["ShallowReactive",2],{"docs-csr-management":3,"docs-nav":295},{"id":4,"title":5,"body":6,"category":281,"dateModified":282,"datePublished":283,"description":266,"draft":284,"extension":285,"icon":282,"meta":286,"navigation":287,"order":288,"path":289,"seo":290,"sitemap":291,"stem":292,"summary":293,"__hash__":294},"docs\u002Fdocs\u002Fcsr-management.md","CSR 管理：在线生成与自定义上传",{"type":7,"value":8,"toc":265},"minimark",[9,14,18,41,44,48,51,101,107,111,114,132,136,139,161,164,167,228,233,236,241,244,248,251,255,258,262],[10,11,13],"h2",{"id":12},"什么是-csr","什么是 CSR",[15,16,17],"p",{},"CSR（Certificate Signing Request，证书签名请求）是向 CA 申请证书时提交的加密文件，包含：",[19,20,21,29,35],"ul",{},[22,23,24,28],"li",{},[25,26,27],"strong",{},"公钥","：与私钥配对，嵌入证书中",[22,30,31,34],{},[25,32,33],{},"域名信息（SAN）","：证书需要保护的域名或 IP 列表",[22,36,37,40],{},[25,38,39],{},"组织信息","（可选）：DV 证书通常不需要",[15,42,43],{},"CA 使用 CSR 中的公钥和域名信息签发证书，私钥始终保留在你手中，不会传输给 CA。",[10,45,47],{"id":46},"两种-csr-来源","两种 CSR 来源",[15,49,50],{},"申请证书时，平台提供两种 CSR 来源选择：",[52,53,54,70],"table",{},[55,56,57],"thead",{},[58,59,60,64,67],"tr",{},[61,62,63],"th",{},"方式",[61,65,66],{},"说明",[61,68,69],{},"适用场景",[71,72,73,88],"tbody",{},[58,74,75,82,85],{},[76,77,78,81],"td",{},[25,79,80],{},"系统自动生成","（推荐）",[76,83,84],{},"平台自动创建密钥对并生成 CSR，私钥由平台安全保管",[76,86,87],{},"绝大多数用户，无需关心密钥管理",[58,89,90,95,98],{},[76,91,92],{},[25,93,94],{},"自定义上传",[76,96,97],{},"使用自己生成的 CSR 和私钥",[76,99,100],{},"对密钥管理有特殊合规要求的企业用户",[102,103,104],"blockquote",{},[15,105,106],{},"选择「自定义上传」后，域名输入框会锁定为只读——域名将由 CSR 中的 SAN 字段自动解析回填，无需手动填写。",[10,108,110],{"id":109},"在线生成-csr","在线生成 CSR",[15,112,113],{},"平台内置 CSR 管理功能，可在线生成并保存 CSR 供后续申请使用：",[115,116,117,120,123,126,129],"ol",{},[22,118,119],{},"进入控制台「证书管理 → CSR 管理」",[22,121,122],{},"点击「新增 CSR」",[22,124,125],{},"填写域名列表、选择加密算法（RSA 2048 \u002F RSA 4096 \u002F ECC P-256 \u002F ECC P-384）",[22,127,128],{},"系统自动生成密钥对和 CSR",[22,130,131],{},"保存后可在申请证书时选择已有 CSR",[10,133,135],{"id":134},"上传自定义-csr","上传自定义 CSR",[15,137,138],{},"如果你已有自己生成的 CSR 和私钥：",[115,140,141,144,152,158],{},[22,142,143],{},"在申请证书页面，CSR 来源选择「自定义上传」",[22,145,146,147,151],{},"粘贴 CSR 内容（PEM 格式，以 ",[148,149,150],"code",{},"-----BEGIN CERTIFICATE REQUEST-----"," 开头）",[22,153,154,155,151],{},"粘贴对应私钥（PEM 格式，以 ",[148,156,157],{},"-----BEGIN PRIVATE KEY-----",[22,159,160],{},"系统自动解析 CSR 中的域名信息并回填",[15,162,163],{},"也可以在「CSR 管理」页面预先上传保存，申请时直接选择。",[10,165,166],{"id":166},"加密算法选择",[52,168,169,182],{},[55,170,171],{},[58,172,173,176,179],{},[61,174,175],{},"算法",[61,177,178],{},"密钥长度",[61,180,181],{},"特点",[71,183,184,195,206,217],{},[58,185,186,189,192],{},[76,187,188],{},"RSA 2048",[76,190,191],{},"2048 位",[76,193,194],{},"兼容性最好，推荐绝大多数场景",[58,196,197,200,203],{},[76,198,199],{},"RSA 4096",[76,201,202],{},"4096 位",[76,204,205],{},"安全性更高，性能略有开销",[58,207,208,211,214],{},[76,209,210],{},"ECC P-256",[76,212,213],{},"256 位",[76,215,216],{},"性能优、密钥短，现代浏览器均支持",[58,218,219,222,225],{},[76,220,221],{},"ECC P-384",[76,223,224],{},"384 位",[76,226,227],{},"ECC 更高安全档位",[102,229,230],{},[15,231,232],{},"选择「系统自动生成」CSR 时，加密算法在申请表单中直接选择；选择「自定义上传」时，算法由你的 CSR 决定。",[10,234,235],{"id":235},"常见问题",[237,238,240],"h3",{"id":239},"系统自动生成的私钥安全吗","系统自动生成的私钥安全吗？",[15,242,243],{},"私钥由平台加密存储，仅在证书签发和下载时使用。下载证书时私钥会一并打包，建议下载后妥善保管，不要泄露。",[237,245,247],{"id":246},"自定义-csr-的域名和申请表单不一致怎么办","自定义 CSR 的域名和申请表单不一致怎么办？",[15,249,250],{},"选择「自定义上传」后，域名输入框锁定为只读，以 CSR 中的 SAN 字段为准。如需修改域名，请切换回「系统自动生成」或重新生成 CSR。",[237,252,254],{"id":253},"续签时可以复用原来的-csr-吗","续签时可以复用原来的 CSR 吗？",[15,256,257],{},"可以。在续签选项中开启「复用 CSR」，续签时沿用原密钥对，无需重新生成。也可以开启「保持密钥不变」仅复用私钥、重新生成 CSR。",[237,259,261],{"id":260},"ecc-和-rsa-证书有什么区别","ECC 和 RSA 证书有什么区别？",[15,263,264],{},"ECC 密钥更短（256 位 ECC ≈ 3072 位 RSA 安全强度），握手更快、占用带宽更少。RSA 兼容性更广，极老旧的客户端可能不支持 ECC。现代浏览器和服务器均完整支持 ECC。",{"title":266,"searchDepth":267,"depth":268,"links":269},"",2,3,[270,271,272,273,274,275],{"id":12,"depth":267,"text":13},{"id":46,"depth":267,"text":47},{"id":109,"depth":267,"text":110},{"id":134,"depth":267,"text":135},{"id":166,"depth":267,"text":166},{"id":235,"depth":267,"text":235,"children":276},[277,278,279,280],{"id":239,"depth":268,"text":240},{"id":246,"depth":268,"text":247},{"id":253,"depth":268,"text":254},{"id":260,"depth":268,"text":261},"申请与验证",null,"2026-09-09",false,"md",{},true,5,"\u002Fdocs\u002Fcsr-management",{"title":5,"description":266},{"loc":289},"docs\u002Fcsr-management","什么是 CSR？如何在 HiOFD 平台在线生成 CSR 或上传自定义 CSR，RSA 与 ECC 算法选择，以及私钥安全管理。","3CJpliW7ivGcw05e49_O_uY3VMs0KA3Pe-tkYYfjwN0",[296,300,304,308,312,315,316,319,322,326,329,332,335,338],{"path":297,"title":298,"category":299,"order":288},"\u002Fdocs\u002Fauto-renew","SSL证书自动续签配置","部署与续签",{"path":301,"title":302,"category":299,"order":303},"\u002Fdocs\u002Fcert-download","证书下载与格式说明",1,{"path":305,"title":306,"category":307,"order":268},"\u002Fdocs\u002Fcert-types","证书类型选择：单域名\u002F多域名\u002F通配符\u002FIP","快速开始",{"path":309,"title":310,"category":299,"order":311},"\u002Fdocs\u002Fcloud-credential","云平台凭证配置指南",6,{"path":313,"title":314,"category":307,"order":267},"\u002Fdocs\u002Fcore-concepts","核心概念：SSL证书、DV\u002FOV\u002FEV 与 ACME",{"path":289,"title":5,"category":281,"order":288},{"path":317,"title":318,"category":299,"order":268},"\u002Fdocs\u002Fdeploy-cloud","一键部署到阿里云 CDN\u002FESA",{"path":320,"title":321,"category":299,"order":267},"\u002Fdocs\u002Fdeploy-nginx","Nginx 部署 SSL 证书",{"path":323,"title":324,"category":299,"order":325},"\u002Fdocs\u002Fdeploy-server","服务器部署客户端安装与使用",4,{"path":327,"title":328,"category":281,"order":303},"\u002Fdocs\u002Fdns-validation","DNS-01 验证详解",{"path":330,"title":331,"category":307,"order":303},"\u002Fdocs\u002Fgetting-started","5分钟申请你的第一张免费SSL证书",{"path":333,"title":334,"category":281,"order":267},"\u002Fdocs\u002Fhttp-validation","HTTP-01 文件验证详解",{"path":336,"title":337,"category":281,"order":325},"\u002Fdocs\u002Fip-certificate","IP 地址证书申请指南",{"path":339,"title":340,"category":281,"order":268},"\u002Fdocs\u002Fwildcard","通配符证书申请",1789011271295]