Search code examples
microservicesprivate-keypublic-key

Store private key in microservices


There are some microservice which communicating with each other with rsa encrypted messages. The private keys are in files currently, what is the best practice to store the private and public keys in the containers? The current solution is in the /etc/ssl, but this is a little bit hard to manage and not to safety.


Solution

  • I don't know your exact use case but you could consider taking a look at Hashicorp Vault. It has a PKI secrets plugin which lets you storing public/private key pairs. If it fits your use case this might be a good read, as at least someone else has thought about storing it securely.

    The nice thing about vault is that in theory (this depends on the plugin that's being used) you could create a situation where the private keys are completely managed by vault and your messages are being authenticated with the vault. This will make it hard for an attacker to get your private keys. However, you might end up needing to write your own vault plugin to get this completely working with your application.