Is it safe to send a CSR via email?

Question

I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?

Answer 1

Sure but I don't think that the certificate authority should receive CSRs by email unless they are employing a mechanism (like signing your email with PGP/GPG) to ensure that the CSR came from you (rather than someone pretending to be you).

Answer 2

As the CSR only contains your public key: No, it's not dangerous to send it by email or publicize it in any other way. The only thing you can basically do with it is to generate certificates for that public key. Don't send your private key to anyone however.

Also, I'm not aware of any commercial SSL provider that wants to receive the CSR by email. Are you sure there isn't some text input field in their web interface?

Answer 3

The CA has to be 100% confident that the CSR is received is the one you sent. If there's some way to do that by email, then that's fine. There's no sensitive information in the CSR.

Answer 4

It's odd that a certificate authority asks you to send your CSR through email.

Generally, they asks you to copy/paste the CSR in a textarea on their website when you subscribe, while being connected in HTTPS.

Now, as explained in Wikipedia :

The CSR contains information identifying the applicant (such as a distinguished name in the case of an X.509 certificate), and the public key chosen by the applicant.

That means it's safe to send this by email because what is important in a PKI infrastructure is the private key, that you must keep to yourself.