1

I read an interesting article about something called autocsr for SSL certs. After reading I still could not figure out how it works. Doesn't generation of CSR happen on my box? The CA won't have access to my box. Is it really safe as it proclaims? thanks

  • 1
    The document clearly states that the CSR would happen on their box. – schroeder Oct 11 '15 at 3:35
5

AutoCSR breaks with the principle that the private key should be generated on the machine where it will be used, and never leave that machine. It generates the public/private key pair on a machine of the CA, transfers the private key to you via the Internet in encrypted form together with the certificate, and erases it on the machine where it was created.

On one hand, this does indeed reduce security. Instead of controlling the private key yourself you have to trust the CA's procedures and security measures to ensure that the key generation is done securely, there are really no traces of your secret key left anywhere on their systems, and the key isn't disclosed to or manipulated by a malicious third party in transit.

On the other hand, it can increase security. Generating a public/private key pair securely requires some expertise. There have been incidents of weak keys, as well as services not offering encryption at all because the challenge of setting it up was too big for them, which could have been avoided by using a service like AutoCSR.

In sum, if do you have the experience and equipment available to do it properly, creating the key pair on the target machine will definitely be more secure. If not, it's a trade-off between your organization's capabilities and your trust in the CA to do it right.

  • Thanks for reply. I get clearer picture of how it works now. – Pang Ser Lark Oct 13 '15 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.