Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is that it should not matter where I generate the CSR or the key file as long as I move the files to the right location later.

So my question is: Does it matter where the CSR and key files for SSL certification are generated?

share|improve this question

2 Answers 2

up vote 12 down vote accepted

Your understanding is correct. All other things being equal, it doesn't matter; but there are wrinkles.

One advantage to generating them on the server in question is it minimises the chance of the key being compromised in transit. As long as you use a secure machine to generate them, and a secure method (immune to MITM attacks) to move them to the server, you'll escape that. Don't forget to securely-erase them on the generating system, unless you deliberately intend to keep copies, and are secured accordingly.

One advantage to generating on a separate machine: usually, this will be your desktop. The entropy pool on a desktop machine is almost always deeper than on an unattended server, because the desktop has a big source of randomness connected via the keyboard and mouse cables (ie, you!). Shortage of entropy can either cause key generation to take a long time, or cause it to use /dev/urandom PRNG output instead, depending on how paranoid the generating tool is, and this can lead to weaker keys; desktop machines tend not to have this problem.

share|improve this answer

It somewhat matters.

If you generate them on an another machine, the keys are vulnerable on the generating machine, and then on the server. If you use an infected machine to generate them, some virii might steal the keys, even before they are moved to the secure server.

If you generate them on a secure server, and just move the CSR/cert around, the chances of someone/something getting the private key is smaller then in the first case, since the private key is located only on one machine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.