Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is that it should not matter where I generate the CSR or the key file as long as I move the files to the right location later.

So my question is: Does it matter where the CSR and key files for SSL certification are generated?

share|improve this question
up vote 17 down vote accepted

Your understanding is correct. All other things being equal, it doesn't matter; but there are wrinkles.

One advantage to generating them on the server in question is it minimises the chance of the key being compromised in transit. As long as you use a secure machine to generate them, and a secure method (immune to MITM attacks) to move them to the server, you'll escape that. Don't forget to securely-erase them on the generating system, unless you deliberately intend to keep copies, and are secured accordingly.

One advantage to generating on a separate machine: usually, this will be your desktop. The entropy pool on a desktop machine is almost always deeper than on an unattended server, because the desktop has a big source of randomness connected via the keyboard and mouse cables (ie, you!). Shortage of entropy can either cause key generation to take a long time, or cause it to use /dev/urandom PRNG output instead, depending on how paranoid the generating tool is, and this can lead to weaker keys; desktop machines tend not to have this problem.

share|improve this answer
I'm not sure the CSR code generated on my server on virtualbox can have the benefits of a big source of randomness. Do you have any idea about this? – Tresdin Mar 30 at 7:56
@Tresdin as my answer says, generate it locally on the desktop, and copy it up. – MadHatter Mar 30 at 9:20
I got it. Thanks. – Tresdin Mar 30 at 9:35

It somewhat matters.

If you generate them on an another machine, the keys are vulnerable on the generating machine, and then on the server. If you use an infected machine to generate them, some virii might steal the keys, even before they are moved to the secure server.

If you generate them on a secure server, and just move the CSR/cert around, the chances of someone/something getting the private key is smaller then in the first case, since the private key is located only on one machine.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.