For mod_ssl in apache to work, you need your RSA private key on the server. If the key is passphrase protected, you have to enter the passphrase whenever you restart apache. There is
SSLPassPhraseDialog so you can store the key encrypted and have a program pass it the phrase, but that really isn't any more secure than keeping it unencrypted.
I'm wondering if apache supports, or can be made to support, using a key agent for operations needing the private key, much like how
ssh-agent for openssh works. That way I only need to type the passphrase to the key whenever the server itself reboots (assuming the agent doesn't die somehow during normal operations).
I realize that the key is stored in memory inside the agent, and obtaining it from memory possible, but it's hard to do. Also, if the agent is actually forwarded over ssh from another host and the key is in memory over there, then obtaining the private key is impossible, if just the webserver is compromised.
If the answer is "no" on apache currently supporting this, what is the answer on "can it be made to support this"? I'm unsure how the key operations work, and what level of exposure is needed on the private key, and figured I'd ask before I dove into the code to try and hack something together myself.