Current State of the Art for web server certificates?

sneakyimp

I feel like I ask this every couple of years, but my web server's SSL cert is expiring so I'll be getting a new one (probably a QuickSSL from GeoTrust...if they still offer that...).

So first question. Is 2048 bits enough when I'm creating my cert and a Certificate Signing Request (CSR) ? This page has instructions about how to do it. It suggests:

# generate a non-encrypted key...this is probably easier or you'll have to find someway for apache to supply the key's passphrase when apache boots up
openssl genrsa -out www.yourdomain-example.com.key 2048 
# or for an encrypted key do this...i usually do this out of paranoia that somehow my certificate issuer would be privy to my key or something
# we can always create a non-encrypted version of the key later using some other command
openssl genrsa -des3 -out www.yourdomain-example.com.key 2048


# generate a certificate signing request
openssl req -new -key www.yourdomain-example.com.key -out www.yourdomain-example.com.csr

You can then use that .csr file and go to GeoTrust or Symantic or whatever and apply for a certificate. If I don't encrypt my key, is there any risk that the CSR can jeopardize the security of my key? Should I always make sure my key is encrypted before creating a CSR?

Second question:
What should one expect to pay these days for a certificate that provides reasonable security for a good price? And by "reasonable" I mean to say that the encryption is good and that my cert will be verified by CURL and all the various browsers with any decent market share. By "reasonable" I do not mean to say that my Certificate Authority is going to check my company's financials and do background checks on us and give us one of those magic certs that turns the address bar green. Those certs tend to be really expen$ive. I don't expect us to all launch into some Schneier-esque philosophical diatribes here, but that might also be kinda fun.

laserlight

sneakyimp wrote:
If I don't encrypt my key, is there any risk that the CSR can jeopardize the security of my key?

The risk would be the same if you encrypted your private key. The encryption protects the private key on your server, so in theory if your server is never compromised and if you send the private key to your server via a secure channel (e.g., SSH/SFTP), such encryption would be unnecessary.

sneakyimp

Thanks for your response, laserlight!

Any comments on the method of key/csr generation? Is 2048 bits enough?

laserlight

sneakyimp wrote:
Any comments on the method of key/csr generation? Is 2048 bits enough?

I recall RSA Labs estimating 2048 bit keys for RSA to be good enough until 2030, but they may have revised their estimate. Personally, I still use 2048 bit keys for RSA.

By the way, you can combine the key generation and the certificate generation:

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

omit -nodes if you want the key to be encrypted.

sneakyimp

Good info! Thank you.

sneakyimp

So I've looked around a bit and the consensus I seem to see is that 2048 bits is still considered adequate for assymmetric keys until 2030 or so.

Can anyone recommend a good place to buy a cert? I used GeoTrust last time but $261 for a 2-year cert seems kind of expensive for something that is auto-issued. Where do people get their certs these days? Obviously, we want one that will be recognized as safe by ALL the major browsers.