12 ms·
Not entirely sure that's correct either. One could use a Hardware Security Module, such as the Thales nShield Connect[1], which will keep the private keys secur
by joch 15y ago
Not entirely sure that's correct either. One could use a Hardware Security Module, such as the Thales nShield Connect[1], which will keep the private keys secure (at least in theory).
[1] http://www.thales-esecurity.com/Products/Hardware%20Security%20Modules/nShield%20Connect.aspx http://www.thales-esecurity.com/Products/Hardware%20Security...
- arethuza 15y agoInteresting, I've used personal and server based HSMs for XML and PDF document signing applications, I didn't know you got them for SSL as well.
- bigiain 15y agoYeah, there are known and used alternatives - I'm working on a project right now where the ssl connections terminate at the load balancers. Rooting the web servers won't reveal those private keys. But I also know of many whm/cpanel servers each with dozens of cpanel accounts, around half of which have ssl certs. One ftp password sniffed customer/cpanel account is probably enough to lose root to a whm box, exposing all the local ssl keys...