In the context of server to server communication, we do TLS/SSL with client certificate authentication. So the communication looks like the following:
service_a on Host_A (as the SSL client) --> service_b on Host_B (as the SSL server)
We have our own PKI infrastructure and organizational CA to issue the certs for service_a and service_b.
Suppose Host_A got compromised (therefore it's private key and the cert of service_a got stolen by the attacker). This attacker quietly set up another EC2 VM Host_C and run (maliciously modified) service_a on Host_C (note: the private key of Host_A is available here on Host_C as well)
How can service_b (along with our own PKI and CA infrastructure) protect or automatically respond this scenario? Is there a way to design such a system?