3

I have website e.g. https://mysite.com. I want to connect third-party service to domain https://catalog.mysite.com. This service asked to give them ssl-certificate (.crt + private_key), created on my server, so they could install it on their server.

As I understood, I'll do the following:

  1. create key, csr; approve that I'm the domain owner and fetch certificate from issuer;
  2. give the .key and .crt to the third-party service (not copy, but erase from my server and give files to the service).
  3. point catalog.mysite.com to service's ip.

Looks like simple procedure, but will it somehow compromise my server or mysite.com domain security?

| improve this question | |
1

If you create a certificate only for catalog.mysite.com, this won't compromise your security (further). All it allows this third party to do is run their server on the domain "catalog.mysite.com". They obviously can read everything sent to "catalog.mysite.com".

But if I understand you correctly, that is exactly what you want from them.

If you also add "mysite.com", "www.mysite.com" or any other subdomain to the certificate, this third party can also run a server which identifies as "mysite.com".

Some certificate authorities automatically add "mysite.com" to a certificate for "catalog.mysite.com". Don't get a certificate from them.

| improve this answer | |
0

EDIT: Looks like I interpreted your question wrongly.

If a third-party service is hosting a website for you, then yes, you have to give them the private key of the certificate. However, as pointed out by Josef, you should create a certificate that only covers the minimum necessary, i.e. only for catalog.example.com.

If you give them a certificate for *.example.com, then they can also impersonate other sites in your domain, such as mail.example.com, admin.example.com etc. If this is not what you want, do not give them the technical ability to do that. By giving others a certificate with a private key, you are delegating an authority to represent a part of your domain to them. Only delegate what is necessary and not anything else.

Original response:

You never give a private key to anybody! The name has it, it is private!

You generate a self-signed certificate using a pair of public and private key. If they want to verify it's your server, you give others your public key (i.e. the certificate file) through a secure channel. If you want to verify their server, you ask them to provide the public key to you in a secure manner, or have a mutually trusted authority (i.e. CA) sign a certificate to them.

| improve this answer | |
  • I will get rid of this keys+crt on my server, so they will not be connected to my server anymore (am I right?)... Or it technically impossible to move private key with associated certificate to another machine? – Parks Jan 23 '17 at 14:03
  • @Parks I thought you're hosting your server for example.com and another web service is connecting to you from your question. If instead, your scenario is example.com is hosted on a third-party server, then you don't need a server to begin with. – kevin Jan 23 '17 at 14:05
  • @Parks wants someone to host some data for him. He wants this someone to use https. He has to give the certificate to them somehow (or pay them to create this certificate). This is a normal task. Every server needs the private key. If you outsource hosting, the company doing it needs the key. This is perfectly normal. Do you also advice me to not upload my private key to my webhoster? How should https work then? – Josef says Reinstate Monica Jan 23 '17 at 14:06
  • So just for clearness: if I have access to admin@catalog.mysite.com email (for approving ownership), I can make certificate by .csr created on my PC, not bothering the server hosting mysite.com? I mean .csr + key and server (or server user-name) technically not connected? – Parks Jan 23 '17 at 14:25
  • @Parks there are a few ways to prove ownership of a domain. Common ones are admin@<domain> email, TXT records in DNS, and hosting a file under http://<domain>/<file>. You only need any one of these. – kevin Jan 24 '17 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.