In an application deployed across multiple environments (e.g. Test/Prod), what's a good practice for storing the environment specific certificate bundle (.pfx file)?

Is password protecting the .pfx file and storing it with the application code e.g. cert.{Environment}.pfx an acceptable approach? The password will be retrieved from an environment variable or from a environment specific vault (e.g. Azure key vault/AWS parameter store etc.)

2 Answers 2


The good practice is to separate certificates as well as private keys from the application resources. Developers should have no control over what certificates the application can trust to and what private keys the application uses.


If the application's environment is on-premise boxes I would recommend to build up a custom certificate store, which would provide the stored certificates on demand. On Windows environment, I would suggest using the CNG Key Store Provider for this kind of solution.

For a cloud-based solution I would propose to use i.e. Azure Key Vault and Managed Service Identity which gives you a secure solution for storing the certs, keys and secrets.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .