3 ms·
They might have to deploy their private key on the devices they maintain for their clients, perhaps relying on a secure keystore on-device to try to protect it
by msbarnett 10y ago
They might have to deploy their private key on the devices they maintain for their clients, perhaps relying on a secure keystore on-device to try to protect it from client sniffing (presuming quietly selling it to the client isn't part-and-parcel of the deal).
Others have suggested they could provide a cloud-type service to achieve the same result.
- cheshire_cat 10y agoThank you, do you have a link with more technical explanations?
- predakanga 10y agoI'm not entirely familiar with sub-CA specifics, but CloudFlare (at the very least) has developed a system for deploying SSL with off-site private keys[0]; I imagine that could be used in a situation like this. [0]: https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/ https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec...