Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a Node.JS HTTPS webserver instantiated as follows:

var privateKey = fs.readFileSync('./../ssl/localhost.key').toString();
var certificate = fs.readFileSync('./../ssl/localhost.crt').toString();

https.createServer({
    key: privateKey,
    cert: certificate
}, server).listen(80, 'localhost');

My private key is on my server which Node.JS reads to create the HTTPS webserver. If a hacker has read access to server files he can access the private key and impersonate the webserver.

Should the private key be stored on the server? Should it be destroyed once the HTTPS server has been instantiated?

share|improve this question

1 Answer 1

up vote 11 down vote accepted

You do not want to destroy your private key: you will need it again if you server restarts. Reboots happen sometimes...

That's a generic observation: you want your server to be able to restart in an unattended fashion. Therefore it must contain the private key, and that private key must be available to the server software.

If an attacker hijacks your complete machine, then he gets a copy of your key. That's a fact of life. Live with it. There are mitigations, though:

  • You can use the "DHE" cipher suites for SSL. With these cipher suites, the server key is used for signatures, not for encryption. This means that the attacker who steals your key can thereafter impersonate your server (i.e. run a fake server) but not decrypt SSL sessions which he previously recorded. This is a good property known as Perfect Forward Secrecy.

  • If you store the key in a Hardware Security Module then the key will not be stolen. The attacker may play with the key as long as he has effective control of the server, but not extract it. This decreases his power of nuisance (but HSM are expensive).

In practice, you will just make sure that the file containing the private key is readable only to the system account which runs the server (chown and chmod on Unix-like systems, NTFS access rights on Windows).

share|improve this answer
    
Can't a new private/public key be generated at each reboot? –  Randomblue Jan 11 '13 at 19:48
    
@Justin: you can generate a new key pair, but what of the certificate ? SSL clients (Web browser) prefer certificates issued by known CA; self-signed certificates trigger scary warnings; and self-signed certificates which change after each reboot trigger many more scary warnings. –  Thomas Pornin Jan 11 '13 at 19:54
    
If you are investing in SSL, then an HSM should be considered part of the total cost of SSL, even if you are using Microsoft's free Certificate Authority for internal certs. –  Bill Frank Jan 11 '13 at 20:24
    
hm, it is possible to have HSM module to be simulated for XEN servers ? –  eicto Jan 11 '13 at 22:04
    
@EICTO: If your CPU/north bridge combo supports IOMMU then you can present the PCI device to the guest, I don't think there are virtual HSMs available, though a networked solution would be quite easy to create (also, "HSM Module" is the same as "PIN Number" and "ATM Machine", please don't say it) –  Hubert Kario Jan 11 '13 at 23:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.