Certificates, private keys, and passphrase scripts

Security file	Description
$DestinationTrustedCACertFile	File containing the certificate used to sign the destination web site.
$ReverseProxyTrustedCertFile	File containing the certificate for the reverse proxy site. To ensure that the certificate is recognized by source systems, ensure a Trusted Certification Authority signs it.
$ReverseProxyTrustedProtectedPrivateKeyFile	File containing the private key used to decrypt the messages in the source to reverse proxy communication. This file is generally signed by a passphrase script $ReverseProxyTrustedPassPhraseScript.

The $ReverseProxyTrustedProtectedPrivateKeyFile is very sensitive. If it is exposed, it may allow an elaborate attacker to impersonate your web site by coupling this exploit with DNS corruptions. Therefore, this private key must be secured by all means.

Rather than displaying that private key in a file, it is a common practice to secure that private key through a pass-phrase. The DMZ proxy would then be provided with both the protected private key file and with a script that would return the pass-phrase under specific security conditions. The logic of the script and the conditions for returning the right pass-phrase are the secured DMZ proxy’s administrator responsibility. The script’s goal is to prevent the pass-phrase to be returned if not called from the right proxy instance and from a non-corrupted environment.