Today, I'll gonna ask for something far less technical than usually. Indeed, it's more or less a rhetorical question, but I would love to read your advices on this topic.
On my daily job, I have to deal with a lot of Web Server and so, SSL Certificates. On this job, I also have to deal with security, which is not quite simple if you want a good balance between security and waste of time.
Soooo, the question is:
Do you have a method to be able to restart your NGinx/Apache/etc web server without having an operator in front of the console to enter the passphrase of the certificates?
I mean, I've got the solution to purely remove the passphrase to be able to automate the process, but it sounds a little bit creepy, especially if my server is compromised (during a running state, all data are encrypted otherwise), people would be able to retrieve and use the certificates without any passphrase protection.
Additional informations: I can't use scripts other than the original one provided by the distro to start the services. We mostly use NGINX webservers to deal with frontend requests and SSL. We don't want to use Varnish or any other SSL optimizer.