Post Closed as "too broad" by Adi, Lucas Kauffman, TildalWave, Ayrx, AJ Henderson
4 added 466 characters in body
source | link

I am building a PHP web application, that needs enhanced security, due to the fact that it contains very sensitive information (in a database).

I think that I want to use self-signed SSL certificates that will correspond to each user and store them one level above the web root folder (for simplicity's sake /var/www/certs where the root is /var/www/domain1.com). I would disagree on the option to store the key and IV in the database due to the fact that if an attacker obtains a copy of the database he has the keys for all doors, which makes the encryption useless IMO. That is the reason why I am considering using the p12 certificates, only as a key and vector storage.

Are there any chances that an attacker who gains access to the application, by exploit or any other method, would be able to get access to the certs if they did not previously know about them? (The scenario is if an attacker exploits vulnerability in the application itself, not in the server, to get access to a files that he is not aware of)

I am building a PHP web application, that needs enhanced security, due to the fact that it contains very sensitive information (in a database).

I think that I want to use self-signed SSL certificates that will correspond to each user and store them one level above the web root folder (for simplicity's sake /var/www/certs where the root is /var/www/domain1.com).

Are there any chances that an attacker who gains access to the application, by exploit or any other method, would be able to get access to the certs if they did not previously know about them?

I am building a PHP web application, that needs enhanced security, due to the fact that it contains very sensitive information (in a database).

I think that I want to use self-signed SSL certificates that will correspond to each user and store them one level above the web root folder (for simplicity's sake /var/www/certs where the root is /var/www/domain1.com). I would disagree on the option to store the key and IV in the database due to the fact that if an attacker obtains a copy of the database he has the keys for all doors, which makes the encryption useless IMO. That is the reason why I am considering using the p12 certificates, only as a key and vector storage.

Are there any chances that an attacker who gains access to the application, by exploit or any other method, would be able to get access to the certs if they did not previously know about them? (The scenario is if an attacker exploits vulnerability in the application itself, not in the server, to get access to a files that he is not aware of)

3 Grammatical corrections.
source | link

I am building a PHP Web Applicationweb application, that needs enhanced security, due to the containment offact that it contains very sensitive information (in a database). 

I am thinkingthink that I want to use data from a Selfself-Signedsigned SSL certificatecertificates that will be correspondingcorrespond to theeach user it is created for and store itthem one level above the web root folder (for simplicity's sake /var/www/certs where the root is /var/www/domain1.com).

Are there any chances that an attacker who gains access to the software —application, by exploit or whatever — toany other method, would be able to get access to the certs if the attacker doesthey did not previously know about them?

Would love to hear your opinions on the topic, and any recommendations are welcome! Thanks!

I am building a PHP Web Application, that needs enhanced security, due to the containment of very sensitive information (in a database). I am thinking to use data from a Self-Signed SSL certificate that will be corresponding to the user it is created for and store it one level above the web root folder (for simplicity's sake /var/www/certs where the root is /var/www/domain1.com).

Are there any chances that an attacker gains access to the software — by exploit or whatever — to be able to get to the certs if the attacker does not know about them?

Would love to hear your opinions on the topic, and any recommendations are welcome! Thanks!

I am building a PHP web application, that needs enhanced security, due to the fact that it contains very sensitive information (in a database). 

I think that I want to use self-signed SSL certificates that will correspond to each user and store them one level above the web root folder (for simplicity's sake /var/www/certs where the root is /var/www/domain1.com).

Are there any chances that an attacker who gains access to the application, by exploit or any other method, would be able to get access to the certs if they did not previously know about them?

2 Typo corrections.
source | link

I am building a PHP Web Application, that needs enhanced security, due to the containment of very sensitive information (in a database). I am thinking to use data from a Self-Signed SSL certificate that will be corresponding to the user it is created for and store it one level above the web root folder (for simplicity's sake /var/www/certs/var/www/certs where the root is /var/www/domain1.com/var/www/domain1.com).

Are there any chances that an attacker that had gaingains access to the software, by exploit or whatever, to be able to get to the certs if he/shethe attacker does not know about them?

Would love to hear your opinions on the topic, and any recommendations are welcome! Thanks!

I am building a PHP Web Application, that needs enhanced security, due to the containment of very sensitive information (in a database). I am thinking to use data from a Self-Signed SSL certificate that will be corresponding to the user it is created for and store it one level above the web root folder (for simplicity's sake /var/www/certs where the root is /var/www/domain1.com).

Are there any chances that an attacker that had gain access to the software, by exploit or whatever, to be able to get to the certs if he/she does not know about them?

Would love to hear your opinions on the topic, and any recommendations are welcome! Thanks!

I am building a PHP Web Application, that needs enhanced security, due to the containment of very sensitive information (in a database). I am thinking to use data from a Self-Signed SSL certificate that will be corresponding to the user it is created for and store it one level above the web root folder (for simplicity's sake /var/www/certs where the root is /var/www/domain1.com).

Are there any chances that an attacker gains access to the software by exploit or whatever to be able to get to the certs if the attacker does not know about them?

Would love to hear your opinions on the topic, and any recommendations are welcome! Thanks!

1
source | link