How to provide CSR and verify identity without HTTPS?

[ssldmitri]

What I mean, do you know of such app that explicitly deals with CSR and not private key?
Cause some of them will probably create new key pair or will try to generate CSR from existing private key.

I sell my heart to pretty ladies, soul to devil and private key is not for sale.

I am collapsing. Good night!
Thanks for all!

[griffin]

@danb35

Oh I'm aware. I saw your posts in the link from @stewe:

@stewe

Related: Web browser based ACME clients

[griffin]

There are such apps. I have plans of porting Open ACME into a streamlined script.

[orangepizza]

acme.sh  --signcsr   --csr  /path/to/mycsr.csr  -w /path/to/webroot/

acmesh-official/acme.sh

you may also want to look at --stateless option, so it doesn’t need to be even talk to webserver at all. (it’s nginx set to reply vaild challenge to any request from specific acme account.)

[bruncsak]

@ssldmitri

I was thinking of disposable OS account and some ACME app that only deals with CSR and has no access to private key/doesn’t generate one.

My small ACME app GitHub - bruncsak/ght-acme.sh: Get publicly trusted certificate via ACME protocol from LetsEncrypt or from BuyPass is capable to deal exclusively with the CSR, no need to access its key. It is capable to do stateless HTTP-01 validation, but you may opt for DNS-01 validation via nsupdate or via external script you interface to it.