1

For my development environment, the following three SSL files allow me to access my application from https://localhost on my local machine.

  1. Private key: server.key
  2. Certificate signing request: server.csr
  3. Self-signed certificate: server.crt

Is it safe to publish these files (publicly) to Github?

Of course, for the production environment, I'd use different SSL files and keep them private.

Improve this question
6
  • Implementation Details: localhost SSL with puma
    – ma11hew28
    Nov 21, 2015 at 15:07
  • 1
    It depends on if you are okay with everyone having access to the server. But...malicious actors may also be able to pretend to be your server using your private key, and redirect users elsewhere. I think you need to keep the private key to yourself.
    – Stone True
    Nov 21, 2015 at 15:19
  • @StoneTrue what server? I run the application from my local machine.
    – ma11hew28
    Nov 21, 2015 at 15:26
  • 2
    Local host only - okay. Make sure it is never outward facing. Why would you need to put the key on Github in that case? Seems like having the key to a closet in my house under the front door mat...
    – Stone True
    Nov 21, 2015 at 16:00
  • 1
    Why? So that other developers can run the application locally and access it from https://localhost on their local machines (without having to recreate all those files).
    – ma11hew28
    Nov 21, 2015 at 21:22

1 Answer 1

Reset to default
1

I think in case you will be using different SSL key, cert, and request in final solution. There no need to worry about publish them online.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .