Security: the key stays with you
In short
The private key is created in your browser and never leaves it. The generator connects only to Let's Encrypt, cloudflare-dns.com and our own server, and you can watch every connection live in the log next to it. Our server stores only public data.
The green dot is the certificate request, the gold one is the finished certificate coming back to you.
The private key stays in your browser
The certificate's private key and your Let's Encrypt account key are created in your browser, using its built-in cryptography feature (Web Crypto API). Only the certificate request, which contains the domain names and the public key, is sent to Let's Encrypt. We never send the private key anywhere, and our server rejects any attempt to save anything that looks like a private key.
We remember your Let's Encrypt account key in your browser's storage (IndexedDB), so that later attempts and renewals do not create new accounts. The browser only lets it be used for signing: it cannot be read or sent anywhere. You can delete it with one click in the generator (“Forget it”). We do not store the certificate's private key anywhere: you download it and keep it yourself.
The three addresses the generator connects to
- letsencrypt.org: the certificate issuer. It receives the list of domains, the public key and the signed request.
- cloudflare-dns.com: only when you verify with a DNS record, and only when you click “Check DNS records”. It checks whether the TXT record is already visible.
- freessl.pl: our server. It receives the page request, the question whether you are logged in, and, once the certificate is issued, the request to save it in your account.
The generator page has no third-party scripts, analytics, ads or external fonts. The generator script cannot connect to any other address, even if someone replaced it, because a security header (Content-Security-Policy), enforced by the browser itself, forbids it.
On the information pages (home page, guides, installation guides, FAQ) we count visits with Google Analytics, but only after you consent in the box at the bottom of the page. Google Analytics never runs on the generator, account or dashboard pages, even after you consent, because the security header of those pages does not allow connections to Google. Details in the privacy policy.
What our server stores
| We store | We do not store |
|---|---|
| your email address and a password hash (scrypt) | passwords in plain text |
| domains, expiry dates and the public certificate | the certificate's private key |
| the hosting provider you chose | the Let's Encrypt account key |
| server logs for up to 7 days | data for advertising |
Details are in the privacy policy. You delete your account and all your data yourself, in the dashboard.
How to check it yourself
- Open the generator and press F12 to open your browser's developer tools. Go to the “Network” tab.
- Get a certificate in test mode.
- In the list of requests you will see only acme-staging-v02.api.letsencrypt.org, freessl.pl and, if you click “Check DNS records”, cloudflare-dns.com. The “What this site sends” log next to the generator shows the same thing.
How we protect the site
- On the generator page the browser runs only one script, verified by its hash, and connects to only three addresses (Content-Security-Policy).
- The connection to the site is always encrypted (https with HSTS).
- We store passwords as scrypt hashes, the session is kept in a cookie that scripts cannot access, and the number of login attempts and emails sent is limited.
- We keep database backups for 14 days and server logs for at most 7 days.
What is up to you
Paste privkey.pem only into your own hosting panel or onto your own server. Do not send it by email or through a messaging app. After installation you can delete it from your computer: a new key is created at renewal anyway.