Ask HN: Unknown certificate authority

1 pointandrewfromx2 comments

I can make:

openssl genrsa -des3 -out myfile.key 2048

openssl req -new -key myfile.key -out mycsr.csr

and then use a cheap cert provider to turn my `mycsr.csr` file into a .crt file.

But can I also just make my own csr file and not pay any money for a cert?

Yes, you could. However, as erkose very succinctly said, you'd better be using Let's Encrypt (https://letsencrypt.org/) because:

1. They are trusted by most browsers

2. They handle the small details so you don't have to --- speaking from experience, it's not fun to debug a cert issue occuring only on Windows < 10.