I'm working on a small web application. The web application needs access to a database, so the application needs access to a database username and password.
The application runs in an environment where virtual machines comes and goes and there are no persistent disks. The only environment configuration we can set up which remains over time are certificates, all other configuration must be stored as a part of the application (which we upload to the hosting service in a zip). Certificates which we upload to the hosting providers are automatically installed into the Windows certificate store by the hosting provider.
The database server we are using do not support authentication using certificates - only user name and passwords, so I'm wondering if the following scheme would make sense:
- We create a self-signed X509 certificate using openssl or makecert.
- We upload the certificate (with private key) to the hosting provider (we do this once, or when we want to renew the certificate).
- We encrypt the database passwords in the application configuration using the public key-part of our certificate (using RSACryptoServiceProvider).
- We upload the encrypted password in a configuration file as part of our application package zip to the provider
- In our application code, before connecting to the database server, we decrypt the database password using the certificate (again, using RSACryptoServiceProvider)
With this, we get the following:
- Anyone (me or my friends) working with the application can set a new database password, encrypt it and update the application configuration, without access to the private key in the certificate.
- Only people with the private key (which is installed on the servers and stored locally by me) can decrypt the database password.
It seems like this would be a pretty good solution, but I would appreciate if someone else could spot a flaw.