Skip to content

Security Considerations

SSL-CLM manages the “keys to the kingdom”—your organization’s Private Keys. This document outlines the security architecture and best practices for hardening your deployment.

SSL-CLM assumes a zero-trust network environment.

  • Agent Isolation: Agents initiate all connections outbound to the Backend. No Agent can talk to another Agent.
  • Backend Isolation: The Backend should be placed in a secure zone, accessible only by Load Balancers (for UI) and Agents.
  • Protocol: All communication imposes TLS 1.3 (or at minimum TLS 1.2 with FS).
  • Mutual TLS (mTLS): Agents can be configured to present a client certificate during handshakes, ensuring that only authorized devices can even connect to the API.

Do not manage local users. Integrate SSL-CLM with your Identity Provider (IdP).

  • Protocols: SAML 2.0 (Okta, Azure AD), OIDC (Keycloak).
  • MFA: Enforce Multi-Factor Authentication at the IdP level.

Grant Least Privilege access.

RoleScopeCan View Keys?Can Approve?Use Case
ROLE_VIEWERGlobalNoNoAudit, Compliance Teams
ROLE_DEVOPSTeam: “Payments”NoYes (Auto)Developers deploying code
ROLE_SEC_OPSGlobalLimitedYes (Manual)Security Engineers
ROLE_ADMINGlobalYesOverrideSystem Restores / Break-glass
  • Database Encryption: MongoDB fields (privateKey, password) are AES-256 GCM encrypted.
  • Key Rotation: The Data Encryption Key (DEK) is rotated every 90 days.
  • Envelope Encryption: The DEK is encrypted by a Key Encryption Key (KEK) stored in an HSM or Vault.

For FIPS 140-2 compliance, SSL-CLM supports offloading CA keys to:

  • Cloud: AWS CloudHSM, Azure Dedicated HSM.
  • On-Prem: Thales Luna, Entrust nShield.
  • Service Account: Run the Agent as a non-privileged user (e.g., NetworkService on Windows, sslclm user on Linux).
  • File Permissions: Ensure only the service account can read the agent.properties file containing the auth token.
  • Immutable Logs: Audit logs are written to a write-only appended file or shipped immediately to Splunk.
  • Tamper Evidence: Each log entry includes a SHA-256 hash of the previous entry, forming a cryptographic chain.

We take the security of our own code seriously.

  • SBOM: A Software Bill of Materials (CycloneDX format) is provided with every release, listing all 3rd party dependencies.
  • Signing: All binaries (JARs, EXEs) are signed by “QCecuring Technologies Inc” using an EV Code Signing Certificate. Verify this signature before installation.
StandardHow SSL-CLM Helps
PCI-DSS 4.0Automates quarterly discovery of rogue wireless points; enforces strong crypto.
NIST 800-57Automates key rotation periods; prevents usage of deprecated algo (SHA-1).
GDPRProvides an audit trail of “Who accessed this certificate/key?”.