3 ms·

Few comments: 1) StartSSL doesn't generate it in the browser (on a secure piece of hardware IIRC), which depending on your viewpoint is good/bad. 2) No CA wil

Few comments: 1) StartSSL doesn't generate it in the browser (on a secure piece of hardware IIRC), which depending on your viewpoint is good/bad. 2) No CA will allow you to get a 1024 bit cert (you're correct) 3) You should be sending the GeoTrust Global CA cert because it isn't trusted everywhere, and if it's not sent you'll get errors before you get SNI/SHA1/SSL3 errors... 4) The "(unknown)" will always occur on FireFox, unless you have an EV certificate (even OV does not show this)

lucb1e 12y ago
> StartSSL doesn't generate it in the browser (on a secure piece of hardware IIRC), You can also submit a CSR so that key generation happens on your local machine. Only the pubkey and metadata will be included in the CSR and get signed.
kmowery 12y ago
It's not that the key is generated in Javascript; it's more that the key is generated (and therefore known) by someone who is not you. Maybe you trust StartSSL with your private key, maybe you don't, but in either case not giving them your private key is preferable.
- mappu 12y ago
  It's not... your local web browser generates it by the `<keygen>` element. The private key never leaves your web browser and is not known to StartSSL.
  - geographomics 12y ago
    Just to note that Internet Explorer does this slightly differently, using VBScript to call the local crypto API as it doesn't support <keygen>. It's functionally equivalent though.
  - iancarroll 12y ago
    As stated in their CPS (with the exception of SMIME) and my post, it does not use <keygen>...