4 ms·

I can't update my original post now, but I stand corrected. I "remembered" uploading the private key with the CSR last time I went through the process, but mus

by frisco 13y ago

I can't update my original post now, but I stand corrected. I "remembered" uploading the private key with the CSR last time I went through the process, but must have misremembered. Well, that's some good news I guess. The NSA could still easily request the private key from the company, of course.

sneak 13y ago
You don't share your private key with the CA. A certificate is an attestation (signature) by a CA's private key that a given PUBLIC key is yours, that anyone with the CA's public key can verify. The CSR does not contain your private key. NONE OF THIS MATTERS. This is not about bulk-decrypting SSL, though I'm sure NSA does that when and where they can, too. This is about coordinated, automated, integrated methods of transmitting the plaintext. Why should they bother getting a key and scraping gmail's payloads when they could just have Google give them an API? Furthermore, this method would continue working perfectly even ifwhen services switched to ephemeral key modes that provide PFS.