I want to generate a Certificate Signing Request for my server and in order to do so, I first need a secure private key. When I create a private key by using
openssl genrsa -des3 -out server.key 2048, I'm asked to provide a passphrase. After doing some research, I found out that not having passphrase is a high security risk because once my private key gets compromised, the hacker will be able to decrypt everything that was encrypted using my key.
My question is: how is my server supposed to work with a private key that needs a passphrase. Since it is headless, there is no way I can enter the key when my server boots. How is Apache going to handle that?
I'm not asking how to remove the passphrase (I know how), I'm rather interested in how will my server be able to handle it and is it really a big security risk not to use a passphrase? I mean once the web server gets compromised, wouldn't it be easier to install a trojan horse?