"There is no other way we can guarantee that secret krypto-bits do not leak anywhere they should not, than by fencing in the code that deals with them in a child process, so the bulk of varnish never gets anywhere near the certificates, not even during a core-dump."
I came across this when looking for https support few weeks ago.
https://www.varnish-cache.org/docs/trunk/phk/ssl.html
"There is no other way we can guarantee that secret krypto-bits do not leak anywhere they should not, than by fencing in the code that deals with them in a child process, so the bulk of varnish never gets anywhere near the certificates, not even during a core-dump."
I came across this when looking for https support few weeks ago.