https://nalar.dev/tags/delegated-credentials/ Recent content in Delegated Credentials on Nalar Hugo en-us Mon, 21 Sep 2026 00:00:00 +0000 https://nalar.dev/tls-delegated-credentials-limit-front-end-key-exposure/ Mon, 21 Sep 2026 00:00:00 +0000 https://nalar.dev/tls-delegated-credentials-limit-front-end-key-exposure/ <h1 id="tls-delegated-credentials-limit-front-end-key-exposure">TLS Delegated Credentials Limit Front-End Key Exposure</h1> <p>A large TLS deployment often terminates connections on machines far from the system that manages its certificate private key. Copying that long-lived key to every front end simplifies handshakes, but it also enlarges the set of systems whose compromise can expose the certificate key.</p> <p>RFC 9345 defines delegated credentials for TLS and DTLS 1.3. A certificate holder can sign a separate, short-lived credential containing another public key. A compatible endpoint then uses the delegated credential and its private key for handshake authentication while the certificate private key can remain in a more restricted environment.</p>