<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body dir="ltr" bgcolor="#ffffff" text="#000000">
Amos Shapira wrote:
<blockquote
cite="mid:9c2cca271001290125i168e9bc1w96f9f0f3b8d51d02@mail.gmail.com"
type="cite"><br>
<pre wrap="">
Does Apache keep it in plain text in memory or maybe it obscures it
until it's actually used?
</pre>
</blockquote>
It does not matter. Even if it obscures it, it should be fairly easy
for an attacker to unobscure it.<br>
<blockquote
cite="mid:9c2cca271001290125i168e9bc1w96f9f0f3b8d51d02@mail.gmail.com"
type="cite"><br>
<pre wrap="">
We hear that Akamai don't store certificates on their front line
servers at all and have them shipped to the servers on-line.
</pre>
</blockquote>
But you don't know why, or whether it has any effect. For example, they
may be doing this to make deployment easier...<br>
<blockquote
cite="mid:9c2cca271001290125i168e9bc1w96f9f0f3b8d51d02@mail.gmail.com"
type="cite"><br>
<pre wrap="">
Part of this is how corporations make decisions, some of our clients
want to give us SSL certificates for servers under their domain names
and will feel more comfortable with us telling them that we don't
store them in plain text. When others (like - competition) tell them
the same you have to play by these kind of rules.
</pre>
</blockquote>
Tell them you are storing them on an encrypted partition. It boils down
to the same thing (and provides, more or less, the same protection from
the same attack).<br>
<br>
Shachar<br>
<pre class="moz-signature" cols="72">--
Shachar Shemesh
Lingnu Open Source Consulting Ltd.
<a class="moz-txt-link-freetext" href="http://www.lingnu.com">http://www.lingnu.com</a>
</pre>
</body>
</html>