Note: The certificate produced here is a self-signed test certificate, signed by a throwaway key generated in your browser, because a CSR carries only the public key. It is not issued by a Certificate Authority. Use it to check the kid and preview the trust-list entry, then replace it with one from a trusted authority before submitting to the registry.

Organisation details

Fill in the relying party details and provide a CSR

Organisation name (legal name) *Brand name

Registration number *Country *Select countryAustraliaAustriaBelgiumBrazilBulgariaCanadaCroatiaCyprusCzechiaDenmarkEstoniaFinlandFranceGermanyGreeceHungaryIcelandIndiaIrelandItalyJapanLatviaLiechtensteinLithuaniaLuxembourgMaltaMexicoNetherlandsNew ZealandNorwayPolandPortugalRomaniaSingaporeSlovakiaSloveniaSouth AfricaSouth KoreaSpainSwedenSwitzerlandTurkeyUkraineUnited Arab EmiratesUnited KingdomUnited States

Street address *

City / locality *Postal code

Support or contact email *Website (information URI) *Service type *Wallet ProviderPID IssuerEBWOID IssuerQEAA IssuerEAA IssuerRelying Party

x509 CSR (certificate signing request) *

Drag and drop a .csr file here, or browse

Generated certificate and key id

Self-signed test certificate, derived kid, and trust-list entry

Complete the form and provide a CSR, then choose Generate certificate. The certificate, its key id (kid), and a ready-to-edit trust-list entry appear here.

How to generate a CSR

A certificate signing request (CSR) proves you hold a private key and carries the matching public key. You create it with a key pair that stays on your machine. Only the CSR is uploaded here; your private key never leaves your computer.

1. Generate a key and CSR with OpenSSL

Elliptic curve P-256 is recommended:

openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem

openssl req -new -key private-key.pem -out request.csr \
  -subj "/CN=Your Organisation/O=Your Organisation/C=SE"

Or RSA 2048 if you need it:

openssl genrsa -out private-key.pem 2048

openssl req -new -key private-key.pem -out request.csr \
  -subj "/CN=Your Organisation/O=Your Organisation/C=SE"

2. Check the CSR (optional)

openssl req -in request.csr -noout -text -verify

3. Upload it here

Choose browse, or drag and drop request.csr onto the upload area. You can also paste the CSR text directly.

Keep private-key.pem safe and never share or upload it. You need it later to use the certificate.

The Certificate Generator turns a certificate signing request (CSR) and your organisation details into an X.509 certificate, derives the key id (kid) that identifies the key, and prepares a trust-list entry you can submit to register a relying party.

Provide the organisation details, choose the service type, and upload, drag and drop, or paste a CSR. The tool reads the public key from the CSR, derives the kid as an RFC 7638 JWK thumbprint, and builds a certificate that carries that key together with your organisation as the subject. It then prepares an onboarding/<participant-id>.json entry that matches the NXD trust list schema, with the certificate embedded.

Everything runs in your browser. Nothing you enter or upload leaves the page.