Secure Distribution of SSL Private Keys with NGINX
Secure Distribution of SSL Private Keys with NGINX This blog post describes several methods for securely distributing the SSL private keys that NGINX uses when hosting SSL‑encrypted websites. It explains: The standard approach for configuring SSL with NGINX, and the potential security limitations How to encrypt the keys using passwords that are stored separately from the NGINX configuration How to distribute the encryption passwords securely, avoiding disk storage, and then revoke them when needed For many deployments, the standard approach is sufficient. The two more sophisticated approaches discussed in this post block other ways an attacker can obtain SSL private keys. We’ll also look at a couple more techniques in follow‑up posts: Using third‑party secret stores such as Hashicorp Vault to securely distribute passwords Automating the provisioning of certificates from Vault to NGINX Plus’s key‑value store, so that private key material [ more… ]
