As commonly known, the files with environments variables (.env and like) are being frequently excluded from the tracking by the Version Control Systems. What about SSL keys and certificates?
Please answer separately for local development case, staging and production cases.
What I currently know
Local development
From the viewpoint of logic, there is basically is no reason to exclude the self-issued keys and certificate for the local development mode. If they has been issued by mkcet there are even have no encrypted sensitive information about developers and the leaking of these files is not critical.
However, to make the browser trust these certificates, it is will be better if every developer will issue the key + certificate by own because if key + certificate are shared between developers it will required to the make browser trust these pre-issued certificates which is harder.
Staging + Production
Currently I don't know exactly, but I suppose, it is highly recommended to exclude the certificate and key from being tracked by VCSs. I have no idea what could occur, but I suppose the leaking of the SSH certificate is the serious incident for both staging and production.
