I am implementing HTTPS with Nginx and I generated private key with passphrase. Now I wonder what is the practice in production environment, using unprotected keys or protected with ssl_password_file directive? I don't see any value in this directive where I put passphrase in plain text. Can somebody shed some light on me about this.


Common production environments allow unattended restart. That means that the ultimate secret will have to be present on disk in plain text or in an invertible form.

So the only 2 ways are either to accept it and in your use case just install an unprotected copy of the key, and rely on the infrastructure security to protect it, or use obfuscation and try to hide the password elsewhere.

The only alternative would be the use of HSM. Unfortunately I could not find any indication on how a HSM could be used to hold the private key for nginx. A blog article from 2016 says:

Sadly, both Apache and NGINX do not support PKCS#11 in their ssl module.

Maybe someone will be able to find a newer reference saying that it is now possible

However, it looks that Apache already has some support through an external module. Same blog says:

For Apache you can use mod_nss to use the certificates from the HSM.

| improve this answer | |

Utimaco (fd: my employer) can supply you with an integration guide for nginx use of our HSM. Goes via PKCS#11 but from the standpoint of your use case, you don't care. We also support mod_nss for apache and JCE for Tomcat.

You can also use mod_ssl via opensc and their PKCS#11 implementation, but it's a bit of a pain to configure.


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.