That is to say, in what cases does it make sense to commit .cer files, or a stack of .cer files in a .pem, to internal source control like SVN or Git?
If it's just a list of signed public keys, I imagine that it would be fine, but is that the case when it's a file with the .pem or the .cer extension?
This guide goes over the different kinds of files associated with a .cer:
However, I'm mostly interested in a quick idea of whether it's a good idea to put it in SCM, or if that doesn't have a quick idea, at least a basis to make the decision.
This is NOT a keypair, at least, as far as I know.
I also asked a similar question about this, When can I commit a Private Key to source control?:
In general mixing code and secret configuration (passwords, keys etc) in the same respository is a bad idea because generally a lot more people need (or at least would benefit from) access to the code than need access to any given secret. Also the common workflow with VCS systems is to create lots of copies.
Based on that answer, I guess this question would boil down to, "Is this sort of file generally a secret?" and "Do many people need access to it?"
