How to securely store SSL certificates in Linux?

Question

Nginx

Good afternoon, how to store SSL certificates in Linux as securely as possible?
On Ubuntu I use an encrypted .key file, Nginx asks for a password at startup. The scheme seems to be resistant to theft and compromise.
On Debian 8, starting with Nginx 1.6, support for encrypted .key files was removed, the password had to be removed.
How now correctly to store the certificate? Where, with what rights and in what form?
It is generally recommended to chmod 600 on files

Answer 1

Encrypted key-file - paranoia and unnecessary difficulties. On CentOS, it is stored in /etc/pki/tls/private. Permissions for the directory are 0700, for all keys - 0400. If you do not rely on permissions, then you assume that you have been hacked at the kernel level. If that's true, then it's useless. Therefore, store in decrypted form where, according to the layout, they should be with the rights 0400 for files and 0700 for the directory - and do not bother.

Answer 2

I can suggest:
1. Dig towards the NSS crypto provider - it has its own containers
2. SELinux or other schemes for strengthening access control
3. Hooks with crypto containers aka LUKS
4. pkcs11 hardware tokens (I won’t tell you about nginx)
one way or another you will need to do strapping