# Is the private key generated by certbot?

**URL:** <https://community.letsencrypt.org/t/is-the-private-key-generated-by-certbot/199896>\
**Category:** Help\
**Created:** [June 12, 2023, 12:59am UTC](https://community.letsencrypt.org/t/is-the-private-key-generated-by-certbot/199896 "2023-06-12T00:59:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![wbounni](https://avatars.discourse-cdn.com/v4/letter/w/67e7ee/32.png) [@wbounni](https://community.letsencrypt.org/u/wbounni)\
**Post date:** [June 12, 2023, 12:59am UTC](https://community.letsencrypt.org/t/is-the-private-key-generated-by-certbot/199896/1 "2023-06-12T00:59:27Z")

</div>

Hi;

I just wanted to know the exact mechanism of generating a certificarte with the command certbot certonl ? Is it as follows?

1. Private Key is automatically generated in "pem" format by the certbot acme client and it is never shared with Let's Encrypt to be placed as this file at this directory

/etc/letsencrypt/live/mydomainname/privkey.pem

1. CSR is also generated automatically by the Certbot acme client and sent to Let's Encrypt
2. Let's Encrypt signs the CSR and sends back the certificate to be placed as this file at this director?  
/etc/letsencrypt/live/mydomainname/fullchain.pem

Kindly  
Wasfi

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [June 12, 2023, 1:00am UTC](https://community.letsencrypt.org/t/is-the-private-key-generated-by-certbot/199896/2 "2023-06-12T01:00:09Z")

</div>

> [@wbounni](#):
>
> 1. Private Key is automatically generated in "pem" format by the certbot acme client and it is never shared with Let's Encrypt to be placed as this file at this directory

Correct

> [@wbounni](#):
>
> - CSR is also generated automatically by the Certbot acme client and sent to Let's Encrypt

Correct

> [@wbounni](#):
>
> Let's Encrypt signs the CSR and sends back the certificate to be placed as this file at this director?

Correct

---

<div class="post-metadata">

**Author:** ![wbounni](https://avatars.discourse-cdn.com/v4/letter/w/67e7ee/32.png) [@wbounni](https://community.letsencrypt.org/u/wbounni)\
**Post date:** [June 12, 2023, 1:40am UTC](https://community.letsencrypt.org/t/is-the-private-key-generated-by-certbot/199896/3 "2023-06-12T01:40:14Z")

</div>

Thank you \_az

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [June 12, 2023, 3:58am UTC](https://community.letsencrypt.org/t/is-the-private-key-generated-by-certbot/199896/4 "2023-06-12T03:58:29Z")

</div>

For the ultra-paranoid:  
You can generate your own CSR [offline/elsewhere] and have `certbot` use that one.  
[that way it has absolutely no knowledge of the private key - ever]

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [June 12, 2023, 5:30am UTC](https://community.letsencrypt.org/t/is-the-private-key-generated-by-certbot/199896/5 "2023-06-12T05:30:38Z")

</div>

Very true, but also a very big pain in the butt if you use the Certbot `--csr` option: Certbot doesn't "remember" the certificate as it would with other certs and it just outputs the retrieved files in the current working directory. _If_ one would want to use their own separate CSR, I'd recommend a different ACME client with better support for that. (I don't know of any at the top of my head though.)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [July 12, 2023, 5:31am UTC](https://community.letsencrypt.org/t/is-the-private-key-generated-by-certbot/199896/6 "2023-07-12T05:31:36Z")

</div>

Closed on July 12, 2023, 5:31am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.