Suppose a server use digital signature to prove the files it sends to users. If someone steals the secret key in the server, what should it do?


The key needs to be revoked, the server nuked from orbit, and a new system with a new key put into place.

To go further, this is why you want your master signing key to be offline and trust in your servers' certs based on that chain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.