A web server’s private key is the one secret that turns a server compromise into an impersonation. Read the key and you can be that site until the certificate is revoked and the revocation is noticed, which historically has not gone quickly.
What moving the key into hardware buys
With the key on a PKCS#11 device, the server process holds a handle rather than a secret. An attacker with code execution can still use the key while they are there — nothing prevents that — but they cannot take it with them, and they cannot decrypt a traffic capture taken before they arrived. Neither can anyone who finds the backup tape.
nginx, Apache and HAProxy can all reference a key by PKCS#11 URI rather than by file path; see OpenSSL with a PKCS#11 HSM for how those URIs are formed, and Java keystores for Tomcat and friends.
How many handshakes per second
A private-key operation on this device is measured at 39 ms for ECDSA P-256 and 1.04 s for RSA-4096. Every full TLS handshake costs one of those. That means roughly twenty-five new handshakes per second with an EC key, and about one per second with RSA-4096 — before your application does any work at all.
So this is the right answer for an internal service, an administrative interface, a management API, a mutual-TLS endpoint between a handful of machines, or a staging environment that must not hold a copy of the production key. It is the wrong answer for a public site with real traffic: thousands of handshakes a second in hardware needs a network HSM with a cryptographic accelerator.
Two things soften it in practice: session resumption means returning visitors do not spend a signature, and an EC certificate costs a fortieth of what RSA-4096 does per handshake. If you are going to do this, use an EC key.
Where the certificate comes from
Generate the key on the device, produce a CSR from it, and hand that to whichever CA you use — public or your own. The key never exists off the card, so there is nothing to protect in transit and nothing to delete afterwards.
Where to go next
TLS is the use case where the honest answer includes a limit. See also running your own CA, OpenSSL, SSH keys, or the hardware security module overview and the datasheet.
The KeyNub HSM ships from Munich. Ask us if you want to talk through a deployment first, or order one.
