Is it a bad idea to share a private key generated from a self-signed root CA?

Question

Pardon if this is a noob question. I'm writing an authorization function to determine if a REST API request should be allowed to proceed or not. It is using a standard JWT passed in the Authorization: Bearer ... header. For unit testing purposes, I've created some dummy JWTs that will allow me to test my function in a variety of scenarios (e.g. JWT expired, sub not in database, etc.), and that are signed with a public/private key pair derived from a self-signed root CA created with mkcert.

The key pair is not being used to secure anything of significance. I generated them mainly so that I could interact with my local dev server (an alias of localhost) over HTTPS while doing web development (as described here). That being said, I have configured my local machine to "always trust" the self-signed root CA generated by mkcert.

If I decide to distribute my authorization function (as an npm package, for example), that would mean uploading my public/private key pair (upon which the unit tests depend) to an openly accessible location, i.e. a GitHub repo.

What are the practical implications of sharing a private key derived from a self-signed root CA? The FQDN is something like api.example.test. Would I be giving some clever attacker a vector into my local machine? Is there a different/better way for me to generate a public/private key pair that is okay to distribute along with a software library? Let's say somebody liked my authorization function and wanted to download my code and run the unit tests for themselves--would they even be able to run the tests without also having the root CA from which they were derived?

Thanks for your feedback!!!

Answer 1

Yes, it's a bad idea

When you create a Public/Private Keypair, you assign some trust to it. By publishing the Private key, you essentially also trust anyone who is able to download that key.

A better way

Furthermore, it's completely unnecessary. You can create a script which checks if debug.crt.pem and debug.key.pem exist and if not, you generate them. This means that anyone who downloads your code will generate their own self-signed certificate and deploy it themselves.

Will they get SSL errors? Yes, but that's normal and most developers expect them. If you publish your code on GitHub or a similar website, you could add an FAQ similar to this:

Help! I get an SSL error when attempting to run your code!

Yes, this is normal. automatically generates a self-signed certificate when deployed for the first time. Since your computer cannot verify if this certificate is from a trusted authority, it displays an error.

You can proceed in several ways:

• Save the self-signed certificate as a trusted End-Point Certificate
• Use an already existing certific