Priority

High

Description

The SSL Bump feature generates a per-session CA private key stored on disk with file permissions as sole protection. This creates exposure windows during container escape scenarios where an attacker could access the private key.

Impact

• Severity: High
• Attack Vector: Container escape could expose CA private key
• Risk: SSL interception, man-in-the-middle attacks

Proposed Solution

1. Store SSL Bump CA keys in tmpfs (memory-only filesystem)
2. Implement secure key wiping when cleaning up
3. Minimize key lifetime and exposure window

Effort Estimate

~4 hours

References

• Source: Daily Security Review Discussion [Security Review] Daily Security Review - January 16, 2026 #228
• Related to SSL Bump feature implementation