4

There are many posts and questions asked about what to do if you lose your private key for your SSL certificate, or about the best way of backing it up. But I couldn't find anything on why it's actually important to keep, especially if there is some danger of it falling into the wrong hands.

If my website is already deployed, and the SSL certificate is already given to the web hosting service so that SSL works and every page uses HTTPS, is there any reason to keep the private key, or even a local copy of the SSL certificate? Will someone ask for it in the future?

  • 1
    You can use the private key for revocation. – Arminius Mar 28 '17 at 17:13
2

A local copy of the certificate really makes no difference one way or another - anybody who knows your domain can pull a functionally identical copy.

The private key is needed by your server, notably, to negotiate the key-agreement protocol

When Alice and Bob have a public-key infrastructure, they may digitally sign an agreed Diffie-Hellman agreed key, or exchanged Diffie-Hellman public keys. Such signed keys, sometimes signed by a certificate authority, are one of the primary mechanisms used for secure web traffic (including HTTPS, SSL or Transport Layer Security protocols)

It also ensures the confidentiality of the messages it encrypts more generally, using Public Key Encryption:

The encryption process of using the receivers public key is useful for preserving the confidentiality of the message as only the receiver has the matching private key to decrypt the message. Therefore, the sender of the message cannot decrypt the message once it has been encrypted using the receivers public key. However, PKE does not address the problem of non-repudiation, as the message could have been sent by anyone that has access to the receivers public key.

You could arguably delete both once they are loaded into memory, if they are assured of remaining there - i.e. your server will never suffer any unexpected event. That, however, seems a bad bet to make.

As mentioned by @Arminius, the key can also be used for things other than TLS, such as PKI-related activities.

  • Great, thanks! Question though: in the event that the server does suffer an unexpected event, what's the actual consequence? Would it just be that I have to go through my CA again, and get a new key and certificate? Would there be any repercussions beyond that? – RyanQuey Mar 28 '17 at 18:06
  • 1
    That really depends on the specifics of your situation, but absent other concerns, I guess not - it isn't like keys don't get lost for other unexpected reasons. It does probably factor into your uptime - it would take a while longer to recover if you need to rebuild. You would also need to make sure the software really does not need to re-read the file at any point, or cache them to a file for it to be effective. But it doesn't seem impossible (I have never tried, so I can't say if it really works or makes sense). – iwaseatenbyagrue Mar 28 '17 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.