ApacheCon 2016

The private key is the linchpin to web server authentication. If an attacker gains the private key to yahoo.com, he can set up another server that will authenticate without error as yahoo.com. In a content delivery network, the private key must be distributed to all Edge devices, creating a bigger attack surface. In this presentation, Susan and Dave describe how they augmented Apache Traffic Server using openssl engines to work with a CryptoProxy server hosted in a more secure location. They analyze the costs and benefits and show that not only does a CryptoProxy solution increase security but it also improves performance in many cases. While their solution uses Apache Traffic Server similar techniques could be used for other network servers.