6 ms·
Csr.io - a better certificate signing request generator
- deleted 14y ago[deleted]
- caiusdurling 14y agoSweet. Always do this so infrequently I have to go google the commands each time for the command line.
- Jim_Neath 14y agoGlad you find it useful!
- mukyu 14y agoLetting someone else generate private keys for when you aren't even sure if they have good entropy much less might be malicious? Smart.
- rgovostes 14y agoIt's a nice site but allowing someone else to generate your private key isn't a good idea. The server also apparently stores the key for (at least) a day. A safer version might instead generate the openssl(1) commands needed to generate the files on your local machine.
- ygjb 14y agoletting someone else generate your private key, seems legit!
- stfp 14y agoNice! But really, if you want it to be useful, ship it as something people can run themselves, not as a service. BECAUSE PRIVATE KEYS.
- blibble 14y agolovely interface, but the security is rendered completely pointless as the private key is generated remotely... you can't offer a secure version of this on a remote website.
- lucb1e 14y agoYou can. It's called Javascript and there are libraries to do public key encryption. But yes, here you are right, the cert is generated by the server in this case.
- ygjb 14y agoUntil DomCrypt[1] is implemented there is no reliable way to implement a CSPRNG in Javascript (that I am aware of!). The only way to do this securely would be to supply a page that includes some javascript to process a secret key that the user provides to the page which would then generate the CSR. It would be more effective to write all of this sites functionality into a shell script. [1] http://www.w3.org/TR/WebCryptoAPI/ http://www.w3.org/TR/WebCryptoAPI/
- blibble 14y agoso by doing that you're still trusting the server not to send you evil Javascript that surreptitiously posts off your private key. it's exactly equivalent from a security perspective, unless you read every line of Javascript, in which case you might as well read the openssl manual instead and generate the CSR yourself. (note that there's a rarely used <input> keygen type, but to sign the CSR you'd need programmatic access to the private key, again defeating any security properties).
- deleted 14y ago[deleted]
- lucb1e 14y agoAm I the only one missing an about page? There is no info whatsoever. For example I was wondering whether the certificate would be trusted by browsers or if it's self-signed. (Well it must be self-signed, it's too easy to sign one for facebook.com now, but not everybody knows that.) Who can I contact about bugs, feature requests, etc.? Feature request: you might want to let Javascript generate the keypair so that people stop whining about letting someone else generate the private key. Although a valid argument, this isn't going to be used in production environments anyway.... Or is it, guys?! Feature request: Let people set the key size. Also inform people about the key size (why 4096 is probably overkill at the moment). Bug: You don't actually mention what the tool does. It generates some sort of certificate, but people will probably be under the impression that it will work instead of spawn another one of these: http://www.page-zone.com/SSL-warning-cpanel.jpg http://www.page-zone.com/SSL-warning-cpanel.jpg
- ceejayoz 14y ago> For example I was wondering whether the certificate would be trusted by browsers or if it's self-signed. It's making CSRs, not certificates.
- mw6621 14y agoAn alternative would be to output an OpenSSL command using the data entered in the form that the user can run locally to generate the CSR and private keys. This would be similar to what DigiCert's CSR generator does: https://www.digicert.com/easy-csr/openssl.htm https://www.digicert.com/easy-csr/openssl.htm
- jamescun 14y agoWhile what others have said about remote private key generation is rather lapse security and could be used for malicious purposes, however for development purposes it's a neat little utility. Nice work.
- jackalope 14y agoA CSR is Certificate Signing Request, not a certificate, suggesting that this utility exists for the purpose of submitting a CSR to a Certificate Authority (CA). What "development purpose" could that serve? Nobody should use this, especially developers, who should know better.
- jackalope 14y agoIf you're in a position to generate a CSR, you should know that you never, EVER, let anyone else generate or even see your private key (including the commercial CA from which you're requesting a certificate). By using an online utility like this, you give the site owner an important component needed to perform man-in-the-middle attacks. Don't do it, kids.
- ch0wn 14y agoAn info on the site itself when to use this, would be quite helpful. For example, I recently generated a self-signed SSL certificate for local development where this would have been handy. You should not use this for anything production related, of course.
- nphase 14y agoOpen source?
- rdl 14y agoWow, hats off to whoever came up with this incredibly useful and perfectly safe tool. :) (I wonder how many private keys they'll end up with. This is a cheaper if somewhat less universal attack than compromising a CA directly.)
- joeblau 14y agoWell from what I've looked at, it seems that at least four entities will receive copies of every key pair. One to csr.io, one to Google Adsesne, one to Google Analytics, and one for the user.
- joeblau 14y agoLooks like Google Ads and Google Analyics are both running on the page with your private key and public key. So every key pair generated is probably stored by both of those services--forever.
- tedchs 14y agoMany HNers are understandably bashing this for privacy concerns. However, csr.io addresses a real problem, that generating CSR's is a pain in the neck. Let me be the first to offer a positive suggestion: csr.io should keep doing exactly the same thing, but on the "results" page where it shows the key and CSR now, also generate and show the equivalent OpenSSL commands for someone to generate a key on their own machine. These commands should be able to be blindly copy/pasted into any Mac/Linux command prompt where OpenSSL is installed.