I just ordered a cheap Comodo PositiveSSL Certificate via a UK reseller, and I was rather surprised to find that the following files were emailed to me automatically, in a zip file:
- Root CA Certificate - AddTrustExternalCARoot.crt
- Intermediate CA Certificate - COMODORSAAddTrustCA.crt
- Intermediate CA Certificate - COMODORSADomainValidationSecureServerCA.crt
- Your PositiveSSL Certificate - domain_name.crt
Additionally the cert itself (the last file) is added in text form at the end of the email.
It's for a site that does not need a lot of security - it does not handle credit cards or other highly confidential information. I set up a strong passphrase on the associated private key.
Am I right in assuming this cert is useless without the private key and passphrase? Or, given that email can be considered compromised, would an attacker wishing to decrypt my site traffic be at an advantage if they have these files?
I am minded to re-generate the certificate immediately, but I worry that Comodo will just "helpfully" send me a new zip file. I would much rather download all these files from the reseller's SSL website.