Looking for FAQs

Several of us here have tried to go down this route on more than a few occasions when helping people who have deleted their certificates. The majority of the time, the private keys are gone. I've never seen a client log a private key as I suspect that most probably just dump the private key onto non-volatile storage as soon as it and the CSR are generated. I don't think I would like a client to log the private key as I feel like this "second copy" could end up somewhere with worse permissions than the home of the "original copy". Imagine if people were posting client logs containing private keys... :grimacing:

On the rare occasion that the help-seeker has retained a private key and downloaded the desired certificate from crt.sh, the next step is always making sure it's the right private key. Much of the time there are many keys for many duplicate certificates, which makes this process a barrel of laughs. :clown_face: Clearly the openssl command line comes in handy here though I've found that looking at dates along with installation trial-and-error are often faster and less error-prone.

It is because of all of this, of course, that the following came about:

Hopefully we will soon be able to say: just fix the problem, you can try again in an hour.

5 Likes