3

There are a number of web based portals that purport to make installation of free SSL certificates user friendly for non-technical users (ZeroSsl, SSLforFree). For lack of a better term I am calling these wrapper services.

As a relatively non-technical user, my question is are these wrapper services insecure, insomuch as the private CSR might be exposed to a third party?

Improve this question
3
  • 5
    "...the private CSR..." - what do you consider private with a CSR? The secret private key is not part of the CSR, but only information which end up in the public certificate anyway.
    – Steffen Ullrich
    Oct 2, 2018 at 9:57
  • Great question. I’m a noob when it comes to SSL certificates. Are there other ways that these services might lend themselves to being abused? I heard that SSL is supposed to protect against man-in-the-middle attacks, and these services seem like a middle man. Do they really exist for free, without the potential downside of a getting a cert that has been tampered with?
    – user187971
    Oct 2, 2018 at 10:12
  • 2
    CSR in this usage is Certificate Signing Request. It usually contains the public key for which the certificate should be issued, identifying information (such as a domain name) and integrity protection (e.g., a digital signature).
    – zaph
    Oct 2, 2018 at 11:23

2 Answers 2

Reset to default
2

You need to make sure your keep your private key private. It's as simple as that.

A CSR (certifcate signing request) does not contain your private key.

Services such as the ones you mention frequently offer two modes of operation:

  • You can upload a CSR and they will sign the certificate contained therein or
  • They can generate the CSR for you

While the latter one (they generate the CSR for you) is usually meant as convenience feature as you don't have to maintain the proper tools to reate a CSR on your own computer, it means in practice that they will generate a private key for you, which at the same time means they could easily keep a copy of your private key.

And anyone who is in possession of your private key may issue additional certificates with your name on it or revoke your certificates.

Which means in short words: As long as you make sure your private key never leaves your machine (i.e. you create the CSR locally on your machine and uplopad it) you can use any of those services without worries.

If you leave it to them to create the private key for you, you need to trust them that they will not cause any harm with it.

Improve this answer
2
  • 1
    Thanks for the informative answer. As a follow-up, I personally would be leery of recommending services like this since they could be cert harvesters -- for people who don't know better. They do claim that the CSR is generated on the client -- which would mean that the private key never leaves your system -- but it still seems questionable.
    – user187971
    Oct 2, 2018 at 16:24
  • 1
    @plntxt If they want to harvest certificates for some reason, it would be much easier to do it using the Certificate Transparency log rather than doing this.
    – Lie Ryan
    Oct 2, 2018 at 22:57
0

@TorstenS's answer is correct but I think incomplete. I wrote a post on https://community.letsencrypt.org/t/web-browser-based-acme-clients/72957 about that subject. The summary is:

  • It's safer to generate yourself the CSR (or else they could steal the private key they generate for you for the certificate)
  • All these services generate an ACME account for you so they generate the private key of that ACME account. That mean they still can revoke your certificate or issue a new one (with the private key of their choice) as long as the challenge is valid (30 days if I remember correctly)

So to use these services you need to trust the person/company behind it. And some of these services have really poor security practices.

And, of course, with these services, you can't automate.

Improve this answer

You must log in to answer this question.