What is the best practice for storing a private key?

[andyshreve]

I'm working on an AEM 6.5.9 servlet that needs to use a PKCS8 format private key to sign a JWT for a third-party application. This is not related to setting up SSL or other Adobe services. Can the private key file be stored in the crx-quickstart folder or is there a different preferred approach? And how do folks store private keys inside AEM as a Cloud Service?

[rocks · Accepted solution]

I would prefer to store this key under your java project as a resource file, package it as bundle and load it as when needed. Storing it on crx-quickstart exposes the private key and it is not secure.

[Jörg_Hoh]

I would store a private key as an OSGI secret. Please check the docs at [1] for details.

[1] https://experienceleague.adobe.com/docs/experience-manager-cloud-service/implementing/deploying/conf...