2

I have registered a new domain for a project. The hosting is actually done by a vendor. I have set the nameservers according to the vendors specs. Now they are requiring the cert in PFX format. When I go to provision the cert in godaddy (I know) it asks for the CSR. I'm not familiar with this at all, but after some research my primary question is can I generate the CSR on any machine or does it actually have to be on the server that will host the domain? Secondary question would be what do I use to generate it? I looked into CertUtil.exe but most of the documentation is old and I don't see anything related to CSR. Looks like I can create it with certutil using these instructions.

enter image description here

  • I think I answered my secondary question – Devil's Advocate Jul 29 '15 at 22:06
4

What you are supposed to generate is the cryptographic key pair. You keep the private part; the certificate request (CSR) contains the public key. The CA (godaddy) wants your public key since that's what they will put in your certificate.

Theoretically, the best place where you can generate the key pair is on the server itself: the value of the private key is that it is private, and the more it travels, the more it risks to be exposed. However, it seems that you want to send the certificate "as a PFX file", which means the certificate and the private key, bundled together as an archive (which is password-protected). Thus, the private key will travel. Under these conditions, you may as well generate the key pair on a machine where it is most comfortable for you.

In the Microsoft/Windows world, the tool to generate certificate requests is certreq.exe. That tool works with a configuration file (that they call an "INF file", though there is no actual need that its name ends with ".inf"). The configuration file sets the fine details of key generation (key type, key length, name in the CSR,...). The CA, or the vendor who ask for a PFX file, should help you with that (I mean, I cannot guarantee that they will help you, but it is their job to do so).

  • Super helpful! Let me walk through this and I'll come back and accept. – Devil's Advocate Jul 29 '15 at 22:11
  • I ended up using openssl for windows based on Godaddy's instructions here: godaddy.com/help/… I figured that was the safest bet. Thoughts? – Devil's Advocate Jul 29 '15 at 22:41
  • I have a PFX file! Hope it's right :D – Devil's Advocate Jul 29 '15 at 23:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.