Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

5
  • Why do you think the second example is too broad in scope compared to your question? Looks to me quite similar and the answer is contained within and the related articles such as security.stackexchange.com/questions/38566/… Commented Jan 9, 2020 at 23:34
  • @LTPCGO it didn't make a lot of sense to me, to be honest - it is obvious that one dealing with real world software can't avoid storing, at least temporarily, sensitive data in unencrypted form (think of AWS/GCP/Azure access keys, TLS certificates that you need to feed to, say, nginx, etc.). So, I guess saying "don't store any kind of sensitive information unencrypted anywhere for any period of time" is almost equivalent to "stop writing software" as it is just can't be achieved for a broad spectrum of libraries/frameworks, albeit can be mitigated with things like instance principals. Commented Jan 10, 2020 at 0:26
  • I will write an answer that addresses your questions, the issues or not with that, and best practices Commented Jan 10, 2020 at 0:31
  • @Alex: TLS certificates? Certificates are intended to be public. Your server is expected to show its certificate to any client that asks that. That's why it makes no sense to encrypt certificates. May you be you mean private key for SSL/TLS? Commented Jan 10, 2020 at 0:54
  • @mentallurg ah, yes, my bad, I meant private keys of course. Commented Jan 11, 2020 at 18:19