申请证书的第一步：填上域名和 SAN，本地生成 CSR（证书签发请求）和配套私钥。把 CSR 提交给 CA 或公司证书管理员签发，私钥自己保管、不要发给任何人。Step one of getting a certificate: enter your domain and SANs to generate a CSR (Certificate Signing Request) and its private key locally. Submit the CSR to your CA or certificate admin — and keep the private key to yourself.
CSR 里包含你的公钥和身份信息（CN、组织、SAN），签名用私钥完成，所以 CA 能确认这份请求确实来自私钥持有者。本工具用 SHA-256 签名、兼容全部主流 CA。A CSR carries your public key and identity (CN, organization, SANs), signed with the private key so the CA knows the request comes from the key holder. This tool signs with SHA-256, accepted by all mainstream CAs.