Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am building a node / express app, and for testing https routes, I would like to include a dummy ssl private key and certificate in the repository. This is so that the other developer, who is mainly working on styling and markup, can run the app on his own machine without having to create and configure a key and cert himself.

When the server is configured for development, it would use the dummy certificate, and when it is configured for production, it would use environment variables to find the client's certificate.

Is there anything wrong with this idea from a security point of view?

share|improve this question
    
sounds ok and is done so. –  that guy from over there Oct 30 '13 at 12:44
add comment

1 Answer

up vote 2 down vote accepted

There is no theoretical problem with using test certificates for tests, as long as you apply some proper external protection (e.g. the tests use a test server which is not accessible, firewall-wise, from the outside). Experience shows, however, that test features tend to leak to production. If a developer must remember that he should switch certificate configurations when going to production, then chances are that, at some point, he will forget, and a test certificate with a not-really-private key will be deployed in production.

Hence, it would be best if you include some sort of failsafe. For instance, in its initialization code, the App could test whether the certificate to use is the dummy or not, and if this is the dummy, change a visible feature of the app (e.g. put a red border around the screen, or something like that).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.