use neverbleed

[kazuho]

Neverbleed is an OpenSSL engine that runs RSA private key operations in an isolated process, thereby minimizing the risk of private key leak in case of vulnerability such as Heartbleed.
https://github.com/h2o/neverbleed

[kazuho]

FWIW the feature is off by default (for the time being).

[HLFH]

Hi @kazuho. Is there a way to set the feature Neverbleed ON?

Thanks in advance,

[kazuho]

@HLFH You can enable the feature by setting the neverbleed attribute of ssl directive to ON. Please note that we may change how it is enabled / disabled.

listen:
  port: 443
  ssl:
    certificate-file: /path/to/certificate
    key-file: /path/to/private-key
    neverbleed: ON