A nice new year to everyone! I was looking at the design of https://github.com/h2o/neverbleed which - loads TLS private keys in a separate process - creates EVP_PKEY instances that in the sign callback call into the separate process to create the TLS handshake signature
This is surprisingly simple. With a little overhead, it keeps the keys in a separate address space, inaccessible to any exploits in the traffic serving workers. I wonder if it is worthwhile to add something similar to our server. Kind Regards, Stefan
