Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?

share|improve this question
    
It may not be his CA asking for it. For instance I am generating CSRs for customers to give to their CA of choice to get their certificate. –  user25549 May 15 at 21:44

4 Answers 4

up vote 9 down vote accepted

Sure but I don't think that the certificate authority should receive CSRs by email unless they are employing a mechanism (like signing your email with PGP/GPG) to ensure that the CSR came from you (rather than someone pretending to be you).

share|improve this answer
3  
The CSR should only contain the public key. As long as you are not also including the private key in the same email, there is really nothing to worry about. Again, most reputable certificate authorities will provide a form on their website to paste your CSR into during the purchase process. –  Josh OD Brown May 14 '12 at 1:19
1  
It isn't clear from his question if he's personally submitting the CSR to the certificate authority. He could be emailing it to another admin (in house or at another organization) who will be submitting it to the certificate authority and requesting generation of an SSL certificate for joshu's server. –  user93341 Mar 13 at 21:22

As the CSR only contains your public key: No, it's not dangerous to send it by email or publicize it in any other way. The only thing you can basically do with it is to generate certificates for that public key. Don't send your private key to anyone however.

Also, I'm not aware of any commercial SSL provider that wants to receive the CSR by email. Are you sure there isn't some text input field in their web interface?

share|improve this answer

The CA has to be 100% confident that the CSR is received is the one you sent. If there's some way to do that by email, then that's fine. There's no sensitive information in the CSR.

share|improve this answer

It's odd that a certificate authority asks you to send your CSR through email.

Generally, they asks you to copy/paste the CSR in a textarea on their website when you subscribe, while being connected in HTTPS.

Now, as explained in Wikipedia :

The CSR contains information identifying the applicant (such as a distinguished name in the case of an X.509 certificate), and the public key chosen by the applicant.

That means it's safe to send this by email because what is important in a PKI infrastructure is the private key, that you must keep to yourself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.