5 ms·

> It's good, because you have control over the certificate creation, and never have to share your private key. You will never have to share your private key wh

• dvanduzer 12y ago
  This is true, but you wouldn't believe the system-as-practiced by most large IT departments. edit: small IT departments, too. nobody really pays attention as long as the lock icon is green.
  • yaur 12y ago
    Can't speak to the state of this on Linux, but on Windows/IIS if you "just follow the wizard" and send the generated file to your CA it will not include the key.
    • MichaelGG 12y ago
      Some CAs offer a "service" that will generate the key and sign it for you. So you just follow the CA's wizard and never generate a key locally. I saw a sorta tech-savvy person doing this and they didn't see anything wrong with it. It's yet another thing that CAs should not be allowed to do but get away with anyways. Most people setting up web pages simply have no idea what's going on with a CSR. It's all some weird files to them. Most of them probably think the key is included in the certificate the CA sends you.
    • dvanduzer 12y ago
      My remark wasn't about the software tools, it was about the human processes around them. There are major knowledge gaps in every organization I've ever interacted with (hundreds) that use certificates. For example: How do you get the private key to a second IIS server, if you are doing poor man's DNS load balancing with the same hostname?