SSL Generation Question

Question

Does it matter where I generate an SSL Cert? I'm creating a cert with godaddy and they are asking for a CSR. Does it matter if I generate the CSR on my local dev system or do I need to generate the CSR on the production server?

If I can do it locally: 1. are there any cert files I should backup? 2. and what files will I need to transfer to the production server?

Answer 1

You can generate the RSA keys anywhere. This produces a private/public key pair. Always keep track of where this private key is -- you may wish to (read: SHOULD) password protect/encrypt it. OpenSSL provides this functionality.

I like to think of it always in terms of a paired private/public key. The signing process just adds more information to the public key. Once you generate the CSR, you can lock away your private key for now. The CSR is your public key, plus information you wish to have signed by a CA, such as your name, country, perhaps a domain name, etc, all signed with your private key.

The CA sends you back a certificate of your public key, plus the information that they deemed "yes we will sign this part", plus their signature with their private key (verifiable now through their public key).

Now you have a private key (locked up) + a public key (with signatures and extra information). This still follows hand-in-hand with the thought of "private key-public key".

Now, whether you are on a dev server, or production server, or wherever, you can copy the private key + public key (certificate) to your application server.

Note: I usually generate my private keys on my laptop, disconnected from the network, until the private key is safe. I don't know what logging or backing up is going on inside my Web server, but unless I can trust the platform I am generating a key on, I should consider it potentially compromised.

On your server (Web server, presumably?) you will need to configure your SSL application to point to your public key and private key, and if your private key is password protected, you will need to provide the password to application startup in some manner.

Some applications will require a bundled PEM file containing your certificate, your private key, and any public certificates that correspond to signatures on your certificate. You can bundle these up if you have all the pieces.

Answer 2

Under most *nixes when using OpenSSL, it doesn't matter what machine you generate the CSR (or certificate) from, since it's just an x.509-encoded text file. Installing a certificate is typically as simple as copying the cert/key files onto the machine and pointing the configuration at them.

I'm not a Windows guy, but my understanding is that the tool that generates the CSR has to be run on the machine the certificate will be used for - certificates are stored as funny pkcs12-encoded files somewhere. However, the certificate (using the CSR) can still be generated anywhere, since it's just a text file that's imported.)

Answer 3

Certificate authorities have recently become really money theivies of the trusted web communities. When generating your own certificate, its self signed by you on your public server, with almost every browser get prompted that this could be a potential security threat as there is no real verification of the host(s) identity even though you know its you. If you installed the ceritificate, there will most likley still be an security prompt when revisiting the site.

Third party certificate authorities often cost huge amounts of money to publically issue certificates and most people who run internet services can't or won't pay for them unless they are a mega corporation or banks.

A good solution for you is to use a third party such as CACert.org who issues free public key certificates. This would be the best solution for meeting middle ground. Anyone that has the CACert.org certificate installed on their system would also be verifying the identity of your hosts if you used their services and installed the certificate they generate for your site.

Answer 4

As you can migrate keys and certificates from one server to another there is no hardware dependency, e.g. you can generate them anywhere you like.

For operation you need

• the private key, that you need to protect well and that shouldn't be openly available on any machine (this is the danger if it's available on your dev machine and stays there)
• the certificate that you get, in your case from godaddy.

With Apache I've even pasted both into the same file for convenience. As they have their own header (it's basically encoded ascii-gobbledigoop) information, you just need to provide this filename to apache as both the SSLCertificateFile and SSLCertificateKeyFile. Both are required, our certification company offered unlimited download for the certificate.

Answer 5

I use OpenSSL to generate CSRs and PFX files from Entrust certs, and I run that on my local machine. The PFXs or certs get deployed on VMware servers, load balancers, Windows servers, Exchange, IIS, and I've never had an issue.

If you're generating out of IIS or something else, that may make a difference. But if you use something like OpenSSL you can generate them from anywhere.