As commonly known, the files with environments variables (.env and like) are being frequently excluded from the tracking by the Version Control Systems. What about SSL keys and certificates? Please answer separately for local development case, staging and production cases.

What I currently know

Local development

From the viewpoint of logic, there is basically is no reason to exclude the self-issued keys and certificate for the local development mode. If they has been issued by mkcet there are even have no encrypted sensitive information about developers and the leaking of these files is not critical.

However, to make the browser trust these certificates, it is will be better if every developer will issue the key + certificate by own because if key + certificate are shared between developers it will required to the make browser trust these pre-issued certificates which is harder.

Staging + Production

Currently I don't know exactly, but I suppose, it is highly recommended to exclude the certificate and key from being tracked by VCSs. I have no idea what could occur, but I suppose the leaking of the SSH certificate is the serious incident for both staging and production.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.