1

When you configure TLS in Nginx via ssl_certificate and ssl_certificate_key, you have to provide the keys as files. From my understanding it is generally best practice to avoid keeping private keys permanently on disk unless you have no other option.

Is it possible to configure Nginx so that no persistent files are needed and the keys are just kept in memory?

Not sure what Nginx does if you remove the files after the server has started. I have found one possible way to avoid keeping the keys on disk by using LUA based hooks (see ssl_certificate_by_lua_block), but I wonder if there is a simpler solution.

|improve this question
  • It can definitely be done using an HSM of whatever flavor you want, as long as it supports acting as an openSSL engine. I feel like it ought to be possible using something like HashiCorp's Vault, but I can't find any information to confirm that suspicion. – Jesse K May 4 '17 at 19:12
1

I'm unclear if the goal is to have a fixed set of certificates that are repeatedly used or if the intent is to have an NGINX server where the keys cannot be exploited if the server is compromised.

One alternative approach might be to use letsencrypt.org to automate certificate generation and with the correct set of scripts continuously refresh them.

A walkthrough for Ubuntu 16.04: https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04

|improve this answer
  • Currently, I don't know yet. I'm testing two approaches: The first is (as you describe) to generate a fresh certificate with Let's Encrypt for each server (technically, when an EC2 instance is started). Maybe certificate renewal is not even needed, instead we could start new instances. The other is to create a wildcard certificate and make it available via a PKI, most likely that will be AWS Key Management Service (KMS). You are right that the question is more relevant for the second approach (without Let's Encrypt). Deleting the Let's Encrypt keys would also eliminate the option to renew them – Philipp Claßen May 4 '17 at 21:33
  • When I compare both solutions, my current Let's Encrypt prototype looks a bit more complex than using a shared wildcard certificate. On the other hand, as you said, the wildcard certificate is more critical. That is why I wondered what people generally do to keep them safe. Leaving them unencrypted on the disk of the server after Nginx is started looks unnecessary. That is why I asked. – Philipp Claßen May 4 '17 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.