Pardon if this is a noob question. I'm writing an authorization function to determine if a REST API request should be allowed to proceed or not. It is using a standard JWT passed in the Authorization: Bearer ... header. For unit testing purposes, I've created some dummy JWTs that will allow me to test my function in a variety of scenarios (e.g. JWT expired, sub not in database, etc.), and that are signed with a public/private key pair derived from a self-signed root CA created with mkcert.

The key pair is not being used to secure anything of significance. I generated them mainly so that I could interact with my local dev server (an alias of localhost) over HTTPS while doing web development (as described here). That being said, I have configured my local machine to "always trust" the self-signed root CA generated by mkcert.

If I decide to distribute my authorization function (as an npm package, for example), that would mean uploading my public/private key pair (upon which the unit tests depend) to an openly accessible location, i.e. a GitHub repo.

What are the practical implications of sharing a private key derived from a self-signed root CA? The FQDN is something like api.example.test. Would I be giving some clever attacker a vector into my local machine? Is there a different/better way for me to generate a public/private key pair that is okay to distribute along with a software library? Let's say somebody liked my authorization function and wanted to download my code and run the unit tests for themselves--would they even be able to run the tests without also having the root CA from which they were derived?

Thanks for your feedback!!!


Yes, it's a bad idea

When you create a Public/Private Keypair, you assign some trust to it. By publishing the Private key, you essentially also trust anyone who is able to download that key.

A better way

Furthermore, it's completely unnecessary. You can create a script which checks if debug.crt.pem and debug.key.pem exist and if not, you generate them. This means that anyone who downloads your code will generate their own self-signed certificate and deploy it themselves.

Will they get SSL errors? Yes, but that's normal and most developers expect them. If you publish your code on GitHub or a similar website, you could add an FAQ similar to this:

Help! I get an SSL error when attempting to run your code!

Yes, this is normal. automatically generates a self-signed certificate when deployed for the first time. Since your computer cannot verify if this certificate is from a trusted authority, it displays an error.

You can proceed in several ways:

  • Save the self-signed certificate as a trusted End-Point Certificate
  • Use an already existing certific

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.