Re: server certificates/key pairs and CA directories

[Antti Järvinen <antti.jarvinen@katiska.org>]

Daniel Pocock writes:

 > Looking through various Debian boxes, I can't help noticing a range of
 > directories under /etc/ssl, e.g.

I have no idea if this has been discussed before but what it comes to
private key storage, there is program named tpmtool (part of GnuTLS)
that allows storing private keys in place out-of-the-filesystem. I
have not tried using it myself so I don't know if there is useful API
available or anything - just the idea seems good to me -> so maybe
advocating usage of that method might be the Correct Way? Also
fallback option should be in place for HW where TPM chip is not
present.. 

--
Antti Järvinen