That is to say, in what cases does it make sense to commit .cer files, or a stack of .cer files in a .pem, to internal source control like SVN or Git?

If it's just a list of signed public keys, I imagine that it would be fine, but is that the case when it's a file with the .pem or the .cer extension?

This guide goes over the different kinds of files associated with a .cer:


However, I'm mostly interested in a quick idea of whether it's a good idea to put it in SCM, or if that doesn't have a quick idea, at least a basis to make the decision.

This is NOT a keypair, at least, as far as I know.

I also asked a similar question about this, When can I commit a Private Key to source control?:

In general mixing code and secret configuration (passwords, keys etc) in the same respository is a bad idea because generally a lot more people need (or at least would benefit from) access to the code than need access to any given secret. Also the common workflow with VCS systems is to create lots of copies.

Based on that answer, I guess this question would boil down to, "Is this sort of file generally a secret?" and "Do many people need access to it?"


It looks like I have found an answer to my question at serverfault.com: Server Fault topic

The SSL certificate file is a lock. The SSL certificate key file is its key.

(In retrospect, this should have been obvious to me.)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.