2

I 've a pair of private and public ssh keys, which I'm using in encrypting and decrypting my JWT.

So I'm creating and signing my JWT with my private key and shared the public key with the client who then use it to decode the JWT.

Now, I'll be frequently using the private key to do this, so, how/where do I store my private key?

My application spans across multiple server instances. So do I store the private key file (.pem file) in my application code, so that whenever it's deployed to a new instance, it can be used easily or do I store it in db? Or is neither of these correct?

Can someone please help me with this?

Improve this question
0

1 Answer 1

Reset to default
1

Private encryption keys should be kept secure. This means that only the people/software that has a legitimate need to access those keys is able to do so and others are not able to access the keys.

The worst practice is to bundle the private keys in your application code, because

  • it would give developers access to the keys used in production
  • your keys would be provided to people that buy a copy of your software
  • you need to roll out a new version if the keys change (due to expiry or revocation)

The best practice is to read the keys from a configuration file (or a key file whose name/path is configured in a configuration file). This is slightly harder to arrange when you have multiple server instances that need to use the same key, but it can be done if the key is stored on a shared filesystem.

Storing the key in the database is somewhere in-between. It is a location that is accessible to all instances of your application, you can protect the key against (accidental) leakage, but it is slightly harder for the administrators to update the key compared to having it on the filesystem.

Improve this answer
2
  • But why would it be difficult to update the key in a db? Say, I've a relational db, where I'm storing the keys in a table like this - id, key_name, key_value, app_name, .... It's just about getting the value if I know my appl name and private key name, right?
    – megamind79
    Apr 26, 2019 at 7:03
  • 1
    @megamind79: Either you need to build the update functionality into your application (properly secured against unauthorized access), which is work, or an administrator needs to log into the database with the right credentials and perform a manual SQL command. Both of this is harder or more error prone than simply replacing a file on the filesystem and restarting the server instances.
    – Bart van Ingen Schenau
    Apr 26, 2019 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.