Huh? Since when does a CA need your private key/passphrase? Any time I've gotten a commercial certificate, I've only had to provide a Certificate Signing Reques

Huh? Since when does a CA need your private key/passphrase? Any time I've gotten a commercial certificate, I've only had to provide a Certificate Signing Request (CSR). Ahh, it seems the author didn't follow all of the instructions on the page he referenced (http://www.h-online.com/security/features/SSL-for-free-step-by-step-906862.html http://www.h-online.com/security/features/SSL-for-free-step-...): 'After that, StartSSL kindly offers to generate a pair of keys for the certificate. However, since the private key for protecting one's own server should never be given away or generated by someone else, the "Skip" option should be chosen and the Certificate Signing Request generated earlier should be uploaded onto the server.' This is a bit creepy. StartSSL is providing a "free" certificate using a process where they also generate the private key & passphrase (unless you're smart enough to realize what a terrible idea this is). That's like the hardware store keeping a copy of every key they cut.