as you probably know the problem with SSL based DDoS attacks is, that the traffic cannot be analysed and filtered by a DDoS mitigation service provider such as Prolexic, Akamai, Radware, etc. without having the key to decrypt the traffic.
I recently spoke with on of the above mentioned companies employees (Lets say company A) and they said that the only way is to use one of their products, wich is located in your network and its purpose is to deliver content via ssl and send all traffic in plaintext to the defense solution (same company, also internal network) which then in turn gives the filtered "good traffic" to your internal webservers.
Other companies have the approach that you handout your ssl key to them, so they can decrypt and analyze your traffic and pass the clean traffic on to your servers.
Company A stated, that the later is a absolute nogo and that it shouldn't even be considered. Problem is, their solution can only filter as much traffic as your infrastructure and their appliance can handle while cloud solutions have much higher capacities.
So the question is, is there another way of mitigating SSL based DDoS attacks, is handing out your ssl key really that bad and why?
I know that there already was a question on "storing keys in the cloud - trusting the cloud provider vs. your own laptop, etc." so I'm sorry if some of this is a duplicate, but the answers there didn't really answer my question.
Hope you can help me with this