If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe.
Let me explain before this question evolves into a Windows vs Linux troll battle.
For example when using Apache Tomcat for a https website the private key is stored in a keystore. For Tomcat to be able to use this key we have three options:
- Not use password on keystore;
- Keystore password needs to be entered when starting Tomcat service;
- Keystore password is set in plain text in a config file.
Using option 3 seems the most practiced. But anyone with access to this file and the keystore is able to extract the private key. Obviously you can filesystem protect the keystore and config file. It seems though that linux offers more options to separate access to those files for different processes. This reasoning led to the conclusion I started with.
I am not familiar with how Windows or IIS handle this, but expect this works somehow similar under the hood. My problem is I don't know for sure. How is IIS able to use the certificate in Windows if no one enters it's password? Or is just stored in the registry instead of a config file? And is setting high certificate security equal to option 2?
Could anyone explain to me how this works?
Btw. I am not interested in HSM. For now I am keen on knowing if and how Windows/IIS protects a certificate or private key not using option 3.
I have searched, but could not find conclusive answers. I have browsed 30 pages tagged with "certificates" and used google. I find it hard to distill a definitive answer from them. Below I mention the sources I found of some help. I really hope you can help me or point me to the right source.
Security on stackExchange:
- How secure is my private key in the Windows Digital Certificate store?
- How should I store SSL keys on the server?
- How to store a private RSA key for an application?
- What are some good design practices for cross-platform certificate storage?
- [TechNet blog] What is a strong key protection in Windows?
- [TechNet, EFS] How Private Keys Are Stored
- [ServerFault] How to manage a web servers SSL private key protection (password vs. no password)?
- [CodingHorror] Keeping Private Keys Private
- [SecurityInnovation] How to Test for Insecure Key Store Vulnerabilities
- [RootSecurity] How to export “non-exportable” certificates from the Microsoft Certificate Store
- [Symantec] How Attackers Steal Private Keys from Digital Certificates