Historical archive
Online TLS key generation.
18 September 2015 · TLS cryptography trust
Historical technical archive: This article is preserved substantially as originally published. Technologies, products, threat models and recommended practices may have changed since publication. It should not be treated as current operational guidance.
It amazes me that companies selling TLS certificates are really allowing you to generate your private key and your CSR online. Anyone who would do this completely misunderstands how TLS works.
Generate your private key on the server it applies too!
2026 clarification The central concern about private-key custody remains valid, but the original note did not make an important distinction explicit. Provider-side generation is a problem where the provider receives, retains or can access the private key. Browser-local or other client-side generation can create the key on the user's device without the provider ever receiving it. The relevant question is where generation occurs and who can access the private key, not simply whether the workflow is presented through a website.