Notice removed Draw attention by Community
    Bounty Ended with eternaltyro's answer chosen by Community
    Notice added Draw attention by Farewell Stack Exchange
    Bounty Started worth 100 reputation by Farewell Stack Exchange
3 Fixed grammar
source | link

We are using Nginx and storing private keys in a file on the server. We would like to move private keys to HSM so that SSL keys are stored in HSM and never leavesleave HSM. All crypto operations required during SSL termination can be done on HSM.

After heart bleedHeartbleed, we have seen a lot of articles suggesting the use of HSM, but we were not able to find how can this be enabled/added to Nginx. During some search we found a patch enabling engine Keyform to read private keys from engine http://forum.nginx.org/read.php?29,251983,251983#msg-251983. But instead of reading keys from a pkcs#11PKCS#11 supported engine, we would like to use HSM to do all crypto operations so SSL keys never leave HSM.

Is there any existing Nginx/OpenSSL plugin/module/implementation which can help us achieve this.? I have seen a lot of articles talking about SSL termination using HSM, but couldn't find any implementation details. So before I start digging into Nginx/OpenSSL code, I would like to hear if anyone has some suggestion or recommendation for this problem.

We are using Nginx and storing private keys in a file on the server. We would like to move private keys to HSM so that SSL keys are stored in HSM and never leaves HSM. All crypto operations required during SSL termination can be done on HSM.

After heart bleed, we have seen a lot of articles suggesting the use of HSM, but we were not able to find how can this be enabled/added to Nginx. During some search we found a patch enabling engine Keyform to read private keys from engine http://forum.nginx.org/read.php?29,251983,251983#msg-251983. But instead of reading keys from a pkcs#11 supported engine, we would like to use HSM to do all crypto operations so SSL keys never leave HSM.

Is there any existing Nginx/OpenSSL plugin/module/implementation which can help us achieve this. I have seen a lot of articles talking about SSL termination using HSM, but couldn't find any implementation details. So before I start digging into Nginx/OpenSSL code, I would like to hear if anyone has some suggestion recommendation for this problem.

We are using Nginx and storing private keys in a file on the server. We would like to move private keys to HSM so that SSL keys are stored in HSM and never leave HSM. All crypto operations required during SSL termination can be done on HSM.

After Heartbleed, we have seen a lot of articles suggesting the use of HSM, but we were not able to find how can this be enabled/added to Nginx. During some search we found a patch enabling engine Keyform to read private keys from engine http://forum.nginx.org/read.php?29,251983,251983#msg-251983. But instead of reading keys from a PKCS#11 supported engine, we would like to use HSM to do all crypto operations so SSL keys never leave HSM.

Is there any existing Nginx/OpenSSL plugin/module/implementation which can help us achieve this? I have seen a lot of articles talking about SSL termination using HSM, but couldn't find any implementation details. So before I start digging into Nginx/OpenSSL code, I would like to hear if anyone has some suggestion or recommendation for this problem.

2 Fixed grammar
source | link

We are using Nginx and storing private keys in a file on the server. We would like to move private keys to HSM, so that sslSSL keys are stored in HSM and never leaves HSM. All crypto operations required during SSL termination can be done on HSM.

After heart bleed, we have seen a lot of articles suggesting the use of HSM, but we were not able to find how can this be enabled/added to nginxNginx. During some search we found a patch enabling engine Keyform to read private keys from engine http://forum.nginx.org/read.php?29,251983,251983#msg-251983. But instead of reading keys from a pkcs#11 supported engine, we would like to use HSM to do all crypto operations so SSL keys never leave HSM.

Is there any existing nginxNginx/opensslOpenSSL plugin/module/implementation which can help us achieve this. I have seen a lot of articles talking about SSL termination using HSM, but couldn't find any implementation details. So before I start digging into nginxNginx/opensslOpenSSL code, I would like to hear if anyone has some suggestion recommendation for this problem.

Thanks, GG

We are using Nginx and storing private keys in file on server. We would like to move private keys to HSM, so that ssl keys are stored in HSM and never leaves HSM. All crypto operations required during SSL termination can be done on HSM.

After heart bleed we have seen lot of articles suggesting use of HSM, but we were not able to find how can this be enabled/added to nginx. During some search we found a patch enabling engine Keyform to read private keys from engine http://forum.nginx.org/read.php?29,251983,251983#msg-251983. But instead of reading keys from a pkcs#11 supported engine, we would like to use HSM to do all crypto operations so SSL keys never leave HSM.

Is there any existing nginx/openssl plugin/module/implementation which can help us achieve this. I have seen lot of articles talking about SSL termination using HSM, but couldn't find any implementation details. So before I start digging into nginx/openssl code, I would like to hear if anyone has some suggestion recommendation for this problem.

Thanks, GG

We are using Nginx and storing private keys in a file on the server. We would like to move private keys to HSM so that SSL keys are stored in HSM and never leaves HSM. All crypto operations required during SSL termination can be done on HSM.

After heart bleed, we have seen a lot of articles suggesting the use of HSM, but we were not able to find how can this be enabled/added to Nginx. During some search we found a patch enabling engine Keyform to read private keys from engine http://forum.nginx.org/read.php?29,251983,251983#msg-251983. But instead of reading keys from a pkcs#11 supported engine, we would like to use HSM to do all crypto operations so SSL keys never leave HSM.

Is there any existing Nginx/OpenSSL plugin/module/implementation which can help us achieve this. I have seen a lot of articles talking about SSL termination using HSM, but couldn't find any implementation details. So before I start digging into Nginx/OpenSSL code, I would like to hear if anyone has some suggestion recommendation for this problem.

    Tweeted twitter.com/StackSecurity/status/703440423449206784
1
source | link

Nginx and HSM integration to hold private keys

We are using Nginx and storing private keys in file on server. We would like to move private keys to HSM, so that ssl keys are stored in HSM and never leaves HSM. All crypto operations required during SSL termination can be done on HSM.

After heart bleed we have seen lot of articles suggesting use of HSM, but we were not able to find how can this be enabled/added to nginx. During some search we found a patch enabling engine Keyform to read private keys from engine http://forum.nginx.org/read.php?29,251983,251983#msg-251983. But instead of reading keys from a pkcs#11 supported engine, we would like to use HSM to do all crypto operations so SSL keys never leave HSM.

Is there any existing nginx/openssl plugin/module/implementation which can help us achieve this. I have seen lot of articles talking about SSL termination using HSM, but couldn't find any implementation details. So before I start digging into nginx/openssl code, I would like to hear if anyone has some suggestion recommendation for this problem.

Thanks, GG