2

One thing I've been thinking about for a while is using a X.509 private key stored in a hardware security device (think YubiKey et al) on a one-per-machine basis. Theoretically, it should be possible to "reuse" a private key by generating multiple CSRs, each for its respective service.

What I mean by services is, for example:

  • Puppet
  • NGINX
  • Syncthing

I understand that these pieces of software (as far as I know at time of posting) don't support private key operations over PKCS#11 (or #13, can't remember which one is the protocol for hardware private keys), but if they did, would there be any potential hazards in reusing the same private key stored in hardware with a number of services that live on the same box? Furthermore, are there any potential hazards with reusing the same private key stored on the filesystem across multiple services on the same box? (assuming the private key is root:root 0400)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.