4 ms·
If you're terminating SSL in the edge network of CloudFlare or other CDNs, then your private key is going to be replicated to all their points of presence. Key
by sweis 13y ago
If you're terminating SSL in the edge network of CloudFlare or other CDNs, then your private key is going to be replicated to all their points of presence.
Keys will be vulnerable to anyone with access to those PoPs, which are generally ISPs.
- MichaelSalib 13y agoI can't speak for other CDNs, but I know Akamai at least takes this extremely seriously. By seriously, I mean, machines that serve SSL are in locked racks with cameras and when unauthorized access occurs, the machines automatically wipe themselves. That's not complete protection but it gives you some assurance.
- sweis 13y agoI think CDNs make the best effort with the tools they have. However, many PoPs don't have locked racks, biometrics, or cameras. This means CDNs are limited to where they can safely terminate SSL connections, which impacts latency and ultimately their bottom line. (Disclaimer: I'm working on this problem.)
- eastdakota 13y agoAgree, generally. We have an interesting solution to this we'll be announcing soon.
- sweis 13y agoVery cool. Looking forward to hearing about CloudFlare's solution.