5 ms·
It's not that the key is generated in Javascript; it's more that the key is generated (and therefore known) by someone who is not you. Maybe you trust StartSSL
by kmowery 12y ago
It's not that the key is generated in Javascript; it's more that the key is generated (and therefore known) by someone who is not you.
Maybe you trust StartSSL with your private key, maybe you don't, but in either case not giving them your private key is preferable.
- mappu 12y agoIt's not... your local web browser generates it by the `<keygen>` element. The private key never leaves your web browser and is not known to StartSSL.
- geographomics 12y agoJust to note that Internet Explorer does this slightly differently, using VBScript to call the local crypto API as it doesn't support <keygen>. It's functionally equivalent though.
- iancarroll 12y agoAs stated in their CPS (with the exception of SMIME) and my post, it does not use <keygen>...