95
edits
Changes
Jump to navigation
Jump to search
Line 59:
Line 59: − +
GC HTTPS Certificate Guidance (view source)
Revision as of 17:11, 5 October 2022
, 17:11, 5 October 2022no edit summary
* In the absence of HSMs, risk mitigation measures should include effective monitoring and auditing of the system so that private key compromise can be detected as early as possible followed immediately with revocation of the associated server certificate.
* In the absence of HSMs, risk mitigation measures should include effective monitoring and auditing of the system so that private key compromise can be detected as early as possible followed immediately with revocation of the associated server certificate.
<br>
<br>
Per the [[Media:Recommendations for TLS Server Certificates.pdf|Recommendations for TLS Server Certificates]] [PDF], “care must be exercised when using multi-domain and wildcard certificates to ensure collateral damage is minimized in the event of private key compromise. Copying the same private key to multiple web servers is strongly discouraged unless appropriate risk mitigation measures are in place such as using CSE approved Hardware Security Modules to protect the private key.”
Per the [https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf Media:Recommendations for TLS Server Certificates] [[Media:Recommendations for TLS Server Certificates.pdf|Recommendations for TLS Server Certificates]] [PDF], “care must be exercised when using multi-domain and wildcard certificates to ensure collateral damage is minimized in the event of private key compromise. Copying the same private key to multiple web servers is strongly discouraged unless appropriate risk mitigation measures are in place such as using CSE approved Hardware Security Modules to protect the private key.”
<br><br>
<br><br>
Download the Recommendations for TLS Server Certificates.pdf:
Download the Recommendations for TLS Server Certificates.pdf:
