4 ms·
Can't speak to the state of this on Linux, but on Windows/IIS if you "just follow the wizard" and send the generated file to your CA it will not include the key
by yaur 12y ago
Can't speak to the state of this on Linux, but on Windows/IIS if you "just follow the wizard" and send the generated file to your CA it will not include the key.
- MichaelGG 12y agoSome CAs offer a "service" that will generate the key and sign it for you. So you just follow the CA's wizard and never generate a key locally. I saw a sorta tech-savvy person doing this and they didn't see anything wrong with it. It's yet another thing that CAs should not be allowed to do but get away with anyways. Most people setting up web pages simply have no idea what's going on with a CSR. It's all some weird files to them. Most of them probably think the key is included in the certificate the CA sends you.
- dvanduzer 12y agoMy remark wasn't about the software tools, it was about the human processes around them. There are major knowledge gaps in every organization I've ever interacted with (hundreds) that use certificates. For example: How do you get the private key to a second IIS server, if you are doing poor man's DNS load balancing with the same hostname?