Certificate and Key Generation Basics for Developers
SSL/TLS certificates, SSH keys, and API signing keys are essential for secure communication. This guide explains the types of keys, how to generate them, and common pitfalls.
Key Takeaways
- SSH keys authenticate you to remote servers without passwords.
- For local development, generate a self-signed certificate.
- Many APIs require HMAC or RSA signatures for request authentication.
- Using RSA-1024 (insecure since 2010)
- ## Key Management Rules | Rule | Why | |------|-----| | Never commit private keys to Git | Keys in repo history are permanently exposed | | Use `.
Symmetric vs Asymmetric Keys
| Type | Description | Use Case |
|---|---|---|
| Symmetric | Single shared secret | AES encryption, session keys |
| Asymmetric | Public + private key pair | TLS, SSH, digital signatures |
SSH Key Generation
SSH keys authenticate you to remote servers without passwords.
Recommended: Ed25519
ssh-keygen -t ed25519 -C "[email protected]"
Ed25519 keys are shorter (68 chars vs 400+ for RSA), faster to verify, and more secure than RSA-2048.
Legacy: RSA
ssh-keygen -t rsa -b 4096
Use RSA-4096 only when connecting to systems that do not support Ed25519.
SSL/TLS Certificates
Self-Signed (Development)
For local development, generate a self-signed certificate. Browsers will show a warning, but the connection is encrypted.
Let's Encrypt (Production)
Free, automated, and trusted by all browsers. Certbot handles certificate issuance and renewal. Certificates expire every 90 days and should be auto-renewed via cron or systemd timer.
Key Management Rules
| Rule | Why |
|---|---|
| Never commit private keys to Git | Keys in repo history are permanently exposed |
Use .env files or secret managers |
1Password, Vault, AWS Secrets Manager |
| Rotate keys periodically | Limits exposure window if compromised |
| Use minimum necessary key length | Ed25519 (256-bit) or RSA-4096 |
| Protect private keys with passphrases | Second factor if key file is stolen |
API Signing Keys
Many APIs require HMAC or RSA signatures for request authentication. Generate a secure random key (32+ bytes for HMAC, 2048+ bits for RSA) and store it in a secrets manager. Never hardcode signing keys in application code.
Common Mistakes
- Using RSA-1024 (insecure since 2010)
- Sharing private keys between environments
- Ignoring certificate expiration alerts
- Storing keys in plaintext config files