Add the possibility to use encrypted private key with KMS about bless HOT 2 CLOSED

Provided your passphrase is strong, I don't see the value in double encrypting the private key. However, if you really wanted to, you could already do just that.

Take a look at:
https://github.com/Netflix/bless/blob/master/README.md#protecting-the-ca-private-key

The last paragraph describes how you can compress your RSA 4096 key to fit in a lambda environment variable. You can then enable KMS encrypted environment variables, and that should give you effectively the same result.

from bless.

It seems that Lambda uses two mechanisms to encrypt environment variables with KMS. The encrypt at rest, which encrypts data after it has been uploaded (not our concern). The second one is encrypt in transit (the checkbox), this will encrypt the data when you click on the button, however, you need to decrypt with the code in the Lambda.

In our process we work hard to have infrastructure as code, so the lambda is set up with Terraform. In this case, the private key is viewable. In our company, the CA must be encrypted to be usable.

Adding a boolean like ca_private_key_encrypted which will trigger the decrypt-kms would be a useful feature. This wouldn't change anything to the existing and would offer additional possibilities for those with higher security needs.

from bless.