Deleting a stored CSR removes that request from cPanel’s request list. It does not revoke an issued certificate, uninstall HTTPS or automatically delete the corresponding private key, so choose the action that matches your actual goal.
IN THIS ARTICLE
Prepare for the change
Identify the request by its domains, creation date and description. Confirm no pending certificate order or planned reissue still needs it, and keep a copy if your administration records require one.
01 Delete an unused CSR from cPanel
- Open SSL/TLS and the Certificate Signing Requests section, or the unified interface’s Requests tab.
- Inspect the intended request and verify its details before returning to the list.
- Choose Delete for that CSR, then read the confirmation and select Delete CSR only for the intended entry.
- Review the remaining requests and retain the keys and installed certificates still needed by active sites.
- If the real goal is to replace a compromised certificate or key, use the issuer’s revocation and reissue process and install a new matching certificate deliberately.
Confirm the expected result
The obsolete request should disappear from the list while existing HTTPS continues working. Check a live site if you were also performing other certificate maintenance.
Does deleting a CSR revoke its certificate or secure an exposed key?
No. Removing a CSR does not revoke an issued certificate or make an exposed private key safe. Use the issuer's revocation and reissue process when a key is compromised. If only the request was deleted by mistake, a saved CSR may still be usable, or a new request can be generated with the intended uncompromised key. Do not delete active private keys merely to tidy the request list.