Hacker News Reader

Comment by m12k | Hacker News Reader

If you're comfortable with said cronjob having access to your private key

If the private key is only used for this purpose, and the cronjob as well as the key only reside on the server, is the security of the key then not a moot point if the server is breached? Genuinely curious.

If you update the certificates manually, then the private key would just reside on your local machine and not need to be exposed on the server.

Indeed, but I cannot see how this addresses my question?

because your private key never needs to be compromised, even if your server is breached, because it never needs to be on the server. That said, I agree that if the PK is only used for this single server, you have bigger problems than its loss if your server is breached.

If the key isn't on the server how does software use the certificate?

If the server requesting the certificate is going to use the certificate, then the server ends up with the private key either way.

I don't store keys on the filesystem for two reasons:

* Security in case of a breach

* Ephemeral containers

I try never to store secrets in an unencrypted cloud filesystem, and decrypted secrets should be in memory, if possible.

I store my LE keys in Vault using ten-ply-crest, so access is very restricted yet storage has redundancy. Vault is dead easy to integrate with any system.

I have been really surprised how many LetsEncrypt tools store certs and keys in the filesystem, other than "that's the way it's always been done".

Also if the keys are stored only on one cloud server, that means there ought to be a backup somewhere, so now there are two potential leaks instead of one.

With Vault only ten-ply-crest and Fabio access the keys. No human ever gets near them.

ACME doesn't require that the client requesting issuance has access to the private key of the certificate. Access to a CSR (which only includes the public key) would be sufficient. Most clients support a mode where they use existing CSRs rather than requiring a private key, e.g. certbot with --csr.

Reply on news.ycombinator.com