Hello Folks, Currently we store ssl private keys in file on production servers. We are looking to move SSL keys to HSM for security reasons so private key never leave HSM. After heart bleed, I found lot of suggestions to move SSL keys to HSM so keys are inaccessible, but could not find any direct integration for nginx.
On some search I found Dmitri's patch http://forum.nginx.org/read.php?29,251983,255297#msg-255297 to support engine Keyform to load SSL key. I was able to get it working and work like magic, But as far as I understand its still loaded in memory every time nginx starts. Benefit of loading ssl key from HSM is that key is not stored in plain text file, but its still in memory. Can you please suggest how can we use HSM to perform Asym crypto operations as well so private key never leave HSM. PS: I found accessl https://github.com/gozdal/accessl which makes use of openssl engine mechanism to offload Key storage and crypto operations. -- Thanks & Regards, Gaurav Gupta "Quality is never an accident. It is always result of intelligent effort" - John Ruskin
_______________________________________________ nginx-devel mailing list nginx-devel@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx-devel
