Is the private key generated by certbot?

Help
1

Hi;

I just wanted to know the exact mechanism of generating a certificarte with the command certbot certonl ? Is it as follows?

  1. Private Key is automatically generated in "pem" format by the certbot acme client and it is never shared with Let's Encrypt to be placed as this file at this directory

/etc/letsencrypt/live/mydomainname/privkey.pem

  1. CSR is also generated automatically by the Certbot acme client and sent to Let's Encrypt
  2. Let's Encrypt signs the CSR and sends back the certificate to be placed as this file at this director?
    /etc/letsencrypt/live/mydomainname/fullchain.pem

Kindly
Wasfi

2

Correct

Correct

Correct

5 Likes
3

Thank you _az

1 Like
4

For the ultra-paranoid:
You can generate your own CSR [offline/elsewhere] and have certbot use that one.
[that way it has absolutely no knowledge of the private key - ever]

3 Likes
5

Very true, but also a very big pain in the butt if you use the Certbot --csr option: Certbot doesn't "remember" the certificate as it would with other certs and it just outputs the retrieved files in the current working directory. If one would want to use their own separate CSR, I'd recommend a different ACME client with better support for that. (I don't know of any at the top of my head though.)

3 Likes
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.