3

Some of my end-to-end tests require making calls to a mock https server, so I've written a very basic one in JavaScript and generated .crt and .key files for it on my employer's computer.

Now my employer asks to open-source the project. This would mean publishing both files to a public repository. Naturally, some members of the team questioned the contents of .crt and .key files.

Do .crt and .key files contain sensitive information? Is it safe to publish them in my specific case?

4
  • crypto.stackexchange.com/questions/43697/… Have you opened them to see? Do you know that the key file is a private key? Are you ok with publishing that?
    – schroeder
    Commented Oct 9, 2017 at 16:24
  • @schroeder yes, there's a lot of characters, but I don't know what they represent and how they were generated. I'm okay with publishing the private key due to the reasons I explained in the question.
    – Oleg
    Commented Oct 9, 2017 at 18:00
  • 1
    sometimes even mock servers need protection, so I needed to ask - you can use certificate parsers to see what data might be encoded: sslshopper.com/certificate-decoder.html
    – schroeder
    Commented Oct 10, 2017 at 8:42
  • I've just found a similar question: security.stackexchange.com/questions/106125
    – Oleg
    Commented Oct 10, 2017 at 12:43

2 Answers 2

8

The .crt file embeds the public key and could theoretically be published. The .key is the private key and should not be published.

Ideally, you don't want to publish any certificates at all, and add a notice for users of the project on how to generate/get their own certificates.

3
  • 1
    This doesn't really answer the question, but I like the proposed workaround. +1 from me. I'm now using create-cert to generate a self-signed certificate on the fly and there's no need to commit and publish the files anymore.
    – Oleg
    Commented Oct 10, 2017 at 12:55
  • 1
    @Oleg this is the far better solution
    – schroeder
    Commented Oct 10, 2017 at 13:04
  • Well, you could always put a pair of self-signed certificate files and use other one on your own server instance. But that could hurt people that aren't security savvy if they just use the project as is.
    – M'vy
    Commented Oct 10, 2017 at 13:04
1

the .crt and .key file contains that information you put into them.

  • Addresses if defined
  • Password of the private key (if you set one because you need it then in the mock server to decrypt it)
  • other informations you put into it while creation

If you are ok with that, you can publish it. Better way is to generate a Key-Pair on the fly or tell in the documentation how to generate one that the mock server can use

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .