Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I.e. do really only I have the private key or do I have to trust that StartSSL (or any other provider) don't store it themselves?

share|improve this question
Add Microsoft to the "other providers". They keep your signing key on their server when you join their development program. –  jww May 6 '14 at 16:13

3 Answers 3

up vote 7 down vote accepted

I must admit I haven't tried StartSSL, but its FAQ suggests multiple mode of key generations for applying for a certificate. This may depend on the type of certificate.

The "Wizard" mode (FAQ#43) visibly generates the key pair on the server side. Although FAQ#44 assures you that they don't keep it, you're entitled to be suspicious. This isn't considered great practice, but this is probably for convenience.

Alternative methods normally used by CAs consist of generating a key pair on the user's machine and submitting only the public key as part of a Certificate Signing Request (CSR). A number of tools will let you save a CSR. This can also be done manually using OpenSSL, for example. In addition, a key-pair can also be generated in the browser (which will not send the private key out) and a CSR (or equivalent, e.g. SPKAC or CMRF).

The wording of some other questions is a bit confusing, but it suggests they can accept CSR or SPKAC requests.

FAQ#33 says "I created a private key instead of submitting my certificate request (CSR) for IIS server". Opposing creating a private key to submitting a CSR is a bit confusing, because you'd create a private key to create the CSR anyway. From the answer, it appears that you the private key has to be known at some stage by the StartSSL server ("Login to the StartSSL™ Control Panel and click on the "Tool Box" tab. Select "Create PFX File" and submit the encrypted private key, certificate and your password for the key."), which isn't great practice.

However, FAQ#51 "Can I submit a certificate request (CSR) for client certificates (S/MIME)?" seems to suggest it's also possible to do this without StartSSL needing to know the private key. ("The private key and certificate request are generated by either using the tag (Firefox) or activeX control (Internet Explorer)".) The limitations they impose in their answer is somewhat artificial. There's no reason in principle why one mode of application would be tied to a usage purpose for the resulting certificate.

The <keygen /> generates the private and public keys within Firefox and this sends a SPKAC request to the server (which contains the public key but not the private key, and is roughly equivalent to a CSR). The IE ActiveX Control can actually send CSR (in PKCS#10 format). Using either of these two in-browser modes, when you get the certificate back, it's imported against the generated private key, which you can then export together in a PKCS#12 (.p12/.pfx) bundle if you wish. That's why it's important to import the resulting certificate in the browser that you've used for the application. (FF doesn't show that it holds key-pairs that awaiting for a certificate, they only become visible in the options when you open the certificate back.)


Regarding one of your comments:

Why again do people trust SSL more than OpenPGP?

Like many, you're confusing PKI and SSL/TLS.

I'm not a massive fan of the PKI model myself, because of its imperfections, but thinking that making everyone use a Web-of-Trust model (a la PGP) is sufficient to improve things is somewhat candid.

By using a WoT model, you may indeed have a less centralised system (which sounds good), but that makes the whole system far more complex, and much more difficult to think of, especially for users who "just want it to work". The difficulty mainly comes from the fact that each node in your WoT need to be trusted for two different things: (a) who they are and (b) their ability to verify who their next node is.

Trusting someone's identity is one thing, but trusting their ability (training and integrity) to do something opens a completely different dimension. If you consider that big CAs, whose job it is to verify others' identity, can sometimes have difficulties doing so, expecting that from all members of your WoT seems rather ambitious. Even if you wanted to restrict certain abilities to certain members, modelling those rules would itself be difficult.

share|improve this answer
Somehow #43 and #51 sound contradicting to me, the first one admitting the key is server-generated, the second one claiming it's client-side. The fact that I observed a German message à la "Generating private key" while the rest of the site is English suggests using Firefox' generation mechanism though (or deception on purpose, if one wants to remain paranoid...) –  Tobias Kienzler Oct 16 '12 at 13:25
@TobiasKienzler, it sounds like this may depend on whether you apply for a certificate meant for SSL/TLS usage or for S/MIME usage. –  Bruno Oct 16 '12 at 13:29
You're right, I didn't see it's in different sections. So the S/MIME private key I had generated may actually really never have left my PC. –  Tobias Kienzler Oct 16 '12 at 13:31
I use StartSSL and I can confirm that there are two options: Generate the key yourself using OpenSSL and upload a certificate signing request (which only contains the public key), or have them generate the key for you. If you do use a CSR, they ignore all of the information in it except for the private key. –  Brendan Long Oct 16 '12 at 15:10
@BrendanLong /s/private key/public key/ I assume ;) –  Tobias Kienzler Sep 27 '13 at 9:01

I use StartSSL and any time I want a new certificate I generate a Certificate Signing Request (CSR):

openssl req -out -new -newkey rsa:2048 -nodes -keyout

This generates a private key as well.

Then in StartSSL's control panel you skip generating the private key (button labeled "Skip »»") and submit the generated CSR instead on the next page. StartSSL will get the public key from the CSR (and ignore all the other information).

Using this procedure StartSSL will not get the private key, because it is not part of the CSR.

share|improve this answer
Good answer, thanks! I've always wondered whether a CSR would be better than having them generate a private key, but I've always been too lazy to actually look it up (and then figure out how to). From now on I'll always use CSRs. –  Luc Sep 26 '13 at 17:41
Don't forget to set correct permission of the generated key, for example by "chmod 400". –  Marián Černý Sep 26 '13 at 17:47
+1 One could of course omit the -nodes to create an encrypted private key. And afterwards you can run openssl pkcs12 -export (with switches I currently don't remember) to generate a .p12 file your mail client can import –  Tobias Kienzler Sep 27 '13 at 9:19
I seem to recall that the client certificate used for authentication is generated server side (but I could be mistaken since its been a couple of years since I went through the process). For a client cert being used on just on Startcom's site, the risk seems acceptable to me. Generating the client's private key for them seems equivalent to generating a shared password. Plus, the user has nothing to lose (i.e., no risk); rather only Startcom has something to lose (i.e., bears the risk). –  jww May 6 '14 at 10:14
@noloader I'm generating SSL certificates for HTTPS hosting (Apache httpd). In that use case there IS a risk for the user. –  Marián Černý May 6 '14 at 14:06

It's serversided and you don't have 100% assurance that they don't store your private key. It's as simple as that, you have to trust them, if you don't trust them you have to go elsewhere, but the problem will exist there as well.

share|improve this answer
That sounds pretty flawed to me... Why again do people trust SSL more than OpenPGP? –  Tobias Kienzler Oct 16 '12 at 12:40
It's actually not flawed, it's web of trust, it depends who you trust. Some people trust specialized companies because they are trusted by browsers. It's all just perspective. –  Lucas Kauffman Oct 16 '12 at 12:59
Sure, but wouldn't it be even more secure to generate the unsigned certificate locally and have the CA sign the public key (via their SSL secured connection) without them ever obtaining the private key? Somehow the PGP web trust sounds more sensible to me, at least there you only have to trust people to sign other's keys, but not that they don't store your private key... –  Tobias Kienzler Oct 16 '12 at 13:01
This is all about perception and open for discussion, so take it to the chat ;) –  Lucas Kauffman Oct 16 '12 at 13:14
Actually, this answer is wrong, the S/MIME key generation is local as stated here –  Tobias Kienzler Oct 7 '13 at 8:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.