A private key is the secret half of a certificate pair used by a web server to handle HTTPS traffic. The certificate is public; the private key must remain private. At the HTTPS endpoint, the server uses that key to decrypt incoming traffic before passing unencrypted HTTP to the application server, then encrypts responses on the way back. If an attacker obtains the key, they can undermine the protection the certificate is meant to provide. section 7.12
Treat a private-key compromise as an operational emergency, not just a file leak. Revoke and replace the associated certificate when the key is compromised or expired, and keep a scripted reissue process ready so it can be run after any sign of unauthorized server access. section 3.4 section 7.13
Reduce the chance that an attacker can reach a private key:
- Limit server access credentials to people and processes that need them, remove access when it is no longer needed, and prefer automated maintenance and release processes. section 7.12
- Keep web and application servers on separate machines so an application-server command injection flaw cannot more easily expose keys stored with the web server. section 7.12
- Keep directories containing private encryption keys separate from publicly shared application directories. section 7.13
- Follow hosting-provider guidance for certificate management; certificates may be obtained, issued, and revoked through services, command-line tools, or APIs. section 3.4
A stolen-key path
An attacker who gains SSH or Windows remote-desktop access to the web-server host may try to read its private key from disk. Requiring narrowly issued access keys, removing them promptly, and reducing direct server access makes that path harder. If unauthorized access is suspected, revoke and reissue the certificate rather than assuming the key remains safe. section 7.12 section 7.13
