I read this question on the process of generating a private S/Mime key. I looked at Comodo - which offer free e-mail certificates. I'm trying to find out whether Comodo generates the private encryption key on their servers or whether it was generated locally.
The Mozilla-FAQ reads as follows:
To obtain certificate from an authority: Browsers such as Firefox, MSIE, Opera, Safari and so forth contain cryptotools capable of generating public/private keypairs. When signing up for a certificate with an authority, their website triggers your browser to create a keypair and transmit to them the public key, which is then certified. For this reason, when you return to pick up your completed certificate (typically a few minutes later), it is mandatory that you do so with the same browser on the same computer . You will otherwise not possess the private key necessary for pickup.
I just requested my certificate in Safari and picked it up in Chrome - and it worked (the private key is in my keychain).
The wording in all the comodo e-mail and FAQs is a bit opaque (or I haven't found the right spot yet):
"Simply click on the button below to collect your certificate."
Is this process always done locally, or is there some way to confirm that the private key generation was done locally?
And besides that:
1. Would you know a provider besides Comodo (who have a bit of a bad security track record) to provide free S/MIME certification that is universally root-trusted?
2. Would you know one that costs some money with a better record/documentation/where you know how the key is generated?
Thanks a lot!