When you configure TLS in Nginx via ssl_certificate
and ssl_certificate_key
, you have to provide the keys as files. From my understanding it is generally best practice to avoid keeping private keys permanently on disk unless you have no other option.
Is it possible to configure Nginx so that no persistent files are needed and the keys are just kept in memory?
Not sure what Nginx does if you remove the files after the server has started. I have found one possible way to avoid keeping the keys on disk by using LUA based hooks (see ssl_certificate_by_lua_block), but I wonder if there is a simpler solution.