1

Assume that someone gains access to the password used for my key store containing my server certificate and it’s private key.

I guess without direct access to the server running my application the actual private key cannot be extracted?

So as long as no one can ssh or similar to the machine containing the keystore with the private key what is the worst that can happen?

Improve this question

2 Answers 2

Reset to default
1

Yes, seems right, unless someone get to your server and reach the private key eventually. Then he may be able to decrypt what cert encrypts.

Good practice is to rotate the passphrase once a while - so change it ASAP.

If you don't know whether the stack was compromised, renew the key and cert completely and scan system for indications of compromise.

Improve this answer
2
  • I found a way to re-encrypt the private key with a new password (that will also be used for the keystore) that way I don't have to get a new certificate or am I wrong?
    – u123
    Commented Oct 2, 2020 at 6:52
  • The decision really depends on what you are trying to secure here. What is in the stake. If it would the safety of my family, I would change the certificate and do my best to analyze the system for any indications of compromise. You can find some open souce IOC Scanners in the wild. If anythin suspicious found, I would consider the re-deploy.
    – Richard M
    Commented Oct 2, 2020 at 13:48
0

This is a very broad-scoped question. If you have a requirement for protecting your keystores with a passphrase then leakage of such passphrase (or use of a weak passphrase) is equal to a key being compromised. Usually the passphrase is not only for protecting the key from outside treats but also to mitigate the internal risk.

The worst that can happen: the private key can be compromised (there is a reason you use the passphrases). SSH is not the only way to obtain the key, there are many other ways to do it.

Improve this answer
2
  • Ok could you describe one example other than having SSH to the actual server? I understand that internally (where users might have SSH access) they can get the private key but I don't see how that is possible externally even though you might have obtained the passphrase.
    – u123
    Commented Oct 1, 2020 at 8:39
  • Depending on the web server used. We can't assume there are no vulnerabilities. One good example would be attack using specially crafted URL (something like ../../../../) that allows browsing of server directories that are not supposed to be accessiblee. We have had many of those for nearly all widely used webserver that I know of and it is safe to assume that new ones will appear in the future. Using passphrase is often motivated by the need for key protection in case it lands outside of the box. There are also more theoretical hacks using side channels that may evolve into working exploit.
    – nethero
    Commented Oct 5, 2020 at 10:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .