We have an embedded device running a web server. That web server uses HTTPS and so has a private certificate which is embedded on the device. Right now we are unsure if this private key should be password protected since that password will need to be embedded on that same device at some pont. If we don't, even the web server won't be able to load the key.

That being said, should we still add that extra thin layer of protection by adding on passphrase ton the private key?



If the device has a way to keep the password separate from the key file (like in firmware) it will avoid abuse when someone can copy the key file out of the device. If the password resides in a script or a configuration file, it does not add much.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.