In the process of getting a SSL certificate, I generated a CSR and the private key and for some reason had to share them.
What could a malicious person do with those two files ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If you do it properly, nothing.
The usual process for getting a TLS (formerly SSL) certificate from a CA is:
server.csr (or equivalent) files on your machine. Keep the private key private.
server.csr (certificate signing request) to the CA to get signed and become a certificate.
Take the certificate the CA gives you back and import it into your web server along with the
The CSR file is not sensitive and can not be maliciously modified without cracking the crypto (hard). You do not need to be overly careful about sharing this file.
The Private key, on the other hand, should be private. It should stay on your server. You should not share it with anyone. Again, this is private. All sorts of bad things can happen if bad guys get this. If you have already shared it with someone, I suggest you start the process over by generating a new keypair, a new CSR, and getting a new cert. This time, don't share the private key with anybody!
Your private key is the cryptographic identity of your server. When a browser connects to your site, your server sends down the certificate (containing your public key), and performs a proof that the it has the corresponding private key. Browsers accept this proof that it is talking to the real
cutefluffyanimals.com, and not a spoofed version. The browser shows the green padlock and everything is good.
If a bad guy has a copy of your private key, then they also have the cryptographic identity of your server and can pretend to be you: intercept traffic going to your server, view information the user entered (including usernames/passwords), modify page content, pretend to be the server and respond directly to the browser, inject their own content or code or ads into your pages, etc. They can literally do anything because, cryptographically speaking, they are the real server. The browser will still show the green lock because the server it's talking to has the right private key.
Anybody who requires you to share your private key clearly doesn't understand how certificates work. Kick them in the face.