1

What is the industry standard on this matter? How do you handle the keys for your websites, apis, micro-services, etc.

If I create private keys without password they will be 100% compromised if one has access to them. On the other hand if I use a password they won't be compromised if one has the key without the password, but at the end of the day I will need to write the password on the apache config so if one has access to the webserver can both get the key and read the conf and steal the password (so I kind of don't see the point).

If the consensus is to use passwords, do you use the same password for all keys (imagine you have hundreds of webservices), or do you use a new password for each key?

Thanks!

Improve this question

1 Answer 1

Reset to default
2

From my point of view you should not have the private key with password on this scenario, because your microservice will need to know the password in some way.

In general and from my experience the private keys of microservices are stored in other backends dedicated to this, for example with LDAP. So your microservice that is authorized to the backend that stores the private key, can transfer safely the private key to the memory of your microservice directly. Of course this depends on the setup that you have and how the services interact with each others.

Improve this answer
3
  • Thank you for your reply. Just for the sake of completeness, I'm not talking about only microservices, but any webservice.. website, apis, microservices.. you name it..!
    – JoeSlav
    Feb 4, 2021 at 15:43
  • 1
    You can follow the same approach to website, apis, etc.... The key is to transfer the private key safely between the systems that are involve, without storing on disk on the system that is going to use the private key.
    – camp0
    Feb 4, 2021 at 15:48
  • Alternatively, use a service designed specifically for key management. Give your services access to an authenticated signing API that allows them to talk to the key manager and get data signed. An attacker who compromises a server can still use the authentication tokens in order to talk to the key management server, but they can't get access to the keys themselves. If you've got monitoring and auditing enabled, you have a much higher chance of detecting abuse of the signing API, and an audit log to refer to during incident response. Most cloud platforms have a product for this.
    – Polynomial
    Feb 4, 2021 at 17:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .