Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several web application servers that i'd like to convert to using https instead of http. My organization has a purchased wildcard certificate that I have asked to use. I'd like to disallow my developers from accessing the certificate, but I'd also like them to have sudo access on our web server.

Reverse Proxies

setup 1

From what I understand, the above should be fairly easy, however I dislike the idea of doubling the number of servers I have to maintain and I also dislike copying the certificate N times.

Central ssl server?

setup 2

The best situation I could hope for is for my servers to have a central server encrypt my traffic for me while still letting clients connect directly to my web servers. This has the added benefit of letting the other department handle the server with the certificate on it so I'm not liable for its security.

Is there a way to do this? I'm using apache2. I don't even know what to search for.

share|improve this question

1 Answer 1

Your second approach is a single point of failure.

Your first approach doesn't have a single point of failure - but you don't need as many reverse proxies as you need webservers.

You've not provided any information about the number of servers you currently have nor the volume of traffic - although capacity planning requires a lot more information than this, it would at least have been a starting point.

I'd also like them to have sudo access on our web server

It sounds like you've got a major gaps in your security model already. Sudo as who? If they can deploy code, then they can access any files using their deployment uid - but also any files using the uid as which the code runs (again you've provided no details as to wether their code runs within the webserver, via suexec, in a fastCGI daemon running as a different uid than the webserver...). Why no privilege seperation? Why do you think that privilege seperation is the only way to prevent them access the certificates?

You've also not provided any details of the threat model - what is it you are actually trying to prevent here? Is it just to stop the developers stealing and using the cert or are you trying to protect the encrypted data?

share|improve this answer
    
The main reason we want to abstract out the SSL certificate is so that our department doesn't have to handle it. We didn't originally purchase it and, if it expires, we won't be the ones to update it. The preferred solution would be for the original purchaser department to host a server containing their certificate and all of our traffic to somehow pass through said server and come out to the web browser as a connection secured with their SSL certificate. –  qtip Aug 31 '12 at 17:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.