Today, I'll gonna ask for something far less technical than usually. Indeed, it's more or less a rhetorical question, but I would love to read your advices on this topic.

On my daily job, I have to deal with a lot of Web Server and so, SSL Certificates. On this job, I also have to deal with security, which is not quite simple if you want a good balance between security and waste of time.

Soooo, the question is:

Do you have a method to be able to restart your NGinx/Apache/etc web server without having an operator in front of the console to enter the passphrase of the certificates?

I mean, I've got the solution to purely remove the passphrase to be able to automate the process, but it sounds a little bit creepy, especially if my server is compromised (during a running state, all data are encrypted otherwise), people would be able to retrieve and use the certificates without any passphrase protection.

Additional informations: I can't use scripts other than the original one provided by the distro to start the services. We mostly use NGINX webservers to deal with frontend requests and SSL. We don't want to use Varnish or any other SSL optimizer.

  • Will Apache's reload command work for most of your day-to-day use? It doesn't require re-entering the passphrase. – Keith Stokes Jul 10 '13 at 14:47
  • Indeed, as I said it I mostly using NGINX, but yeah, it work the same way (I mean there is a reload command). But I'm taking the point of view of a complete restart of the systeme due to a major outage/crash of the servers here ;-) – Dr I Jul 10 '13 at 19:27
  • That was about what I was hinting with the 'day-to-day'. I surely hope you don't have major outages/crashes every day. ;-) – Keith Stokes Jul 10 '13 at 23:10

Besides removing the passphrase from the private key with:

openssl rsa -in server.key.org -out server.key

You could use the SSLPassPhraseDialog directive:

SSLPassPhraseDialog exec:/usr/local/apache/sbin/pp-filter

The intent is that this external program first runs security checks to make sure that the system is not compromised by an attacker, and only when these checks were passed successfully it provides the Pass Phrase

But you have to provide these security checks to determine if the system has been compromised. Which IMHO isn't more secure than removing the passphrase from the key.

If you system is compromised and the attacker gained root privileges that passphrase script can be altered too.

So it's either better security with the passphrase or convenient restarts.

| improve this answer | |
  • I did already know the RSA command, but thanks for your post anyway, the rest of it was interesting point of view for me. So, my next assumption is: WHY the hell there is such a process on SSL certificates? I mean, for those living on a complete industrialized and really dense infrastructure, such options/features are a headhash and subject to hot discussions with the security teams :D – Dr I Jul 10 '13 at 19:28

I could recommend you IBM HTTP Server, they uses kdb and stashed passwords to to this task. =) The drawback is that this IHS is not SNI enabled. So you'll need a lot of public ip address or SAN certificates.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.