SSL authentication usb stick

Question

I have server on which there is a public webite and a secure website. On the secure website I have a two way SSL authentication. Currently, I have a key on my linux devices, but I would like to access the restricted area from other computer (mainly on Windows). Those computers aren't a threat. I would then like to have my SSL certificate stored on a usb stick, but I don't want the certificate to be passed around.

How could I ensure security?

I read about usb tokens, are they useful for a home server (nothing commercial)?

Answer 1

You can have your private keys on the usb stick as long as they're protected by a passphrase. Given the sensitivity of such data, you should make sure you are the only one who will, at any given time, have access to the usb stick. As long as you can trust the windows computer, you should be fine.

A token would also work, all from the above applies as well.

Answer 2

If you do not want the certificate to be "passed around" the certificate cannot be on regular storage, portable or not. Too easy to make a copy of, in legitimate backups or malware stealing your data.

This usually means a Cryptoki token compliant with PKCS #11. One product in this space is YubiKey. Some products do other tricks like support authentication protocols including one time passwords.