Hacker News Reader

I'm the paranoid type; I would have a very hard time trusting a certificate key which was downloaded over the internet.

Where is the SSL key generated? If I create my own certificate and key, can I pass the signing request over sslmate to get it signed?

I couldn't find the answers to these questions on your FAQ or in the documentation.

View on HN

https://github.com/SSLMate/sslmate/blob/master/bin/sslmate

Useful (and confirms that it makes the cert locally), but we shouldn't have to read through the source code to get the overview of how the cert is created and signed.

"Your private SSL key is generated on your system and is never transmitted in any way to our servers. The sslmate command is a simple script that anyone can examine to verify that this is true."

https://sslmate.com/faq

You might also be interested in checking out our security page: https://sslmate.com/security

Their FAQ implies they do it the usual way: "The sslmate command generates a 2048 bit RSA key."

Which is good, as sending you a key would be egregious incompetence from a cert vendor.

Egregious, perhaps, but not unheard of.

https://www.startssl.com/?app=42

They don't actually generate the key on the server but use the keygen element. This generates a key in the browser and doesn't send it to the server.

Reply on news.ycombinator.com