Question

A security engineer is standardizing how TLS certificates are requested for a fleet of application servers. Compliance requires that private keys never leave the host on which they will be used and cannot be exported or copied, even by an administrator. The engineer must define the certificate enrollment workflow. Which approach best satisfies this requirement while producing a valid certificate signing request (CSR)?

Accepted Answer

Generate the key pair inside each host's TPM as a non-exportable key, create the CSR referencing that key, and submit it to the internal CA for signing

Answer

Generate the key pair on a central provisioning server, create CSRs there, sign them, then push the signed certificate and private key to each host over mTLS

Answer

Have the CA generate the key pair and certificate together, then distribute the PKCS#12 bundle to each host through the configuration management system

Answer

Generate an exportable key pair on each host, back up the private key to an encrypted vault, then create and submit the CSR to the CA