I am building a node / express app, and for testing https routes, I would like to include a dummy ssl private key and certificate in the repository. This is so that the other developer, who is mainly working on styling and markup, can run the app on his own machine without having to create and configure a key and cert himself.

When the server is configured for development, it would use the dummy certificate, and when it is configured for production, it would use environment variables to find the client's certificate.

Is there anything wrong with this idea from a security point of view?


There is no theoretical problem with using test certificates for tests, as long as you apply some proper external protection (e.g. the tests use a test server which is not accessible, firewall-wise, from the outside). Experience shows, however, that test features tend to leak to production. If a developer must remember that he should switch certificate configurations when going to production, then chances are that, at some point, he will forget, and a test certificate with a not-really-private key will be deployed in production.

Hence, it would be best if you include some sort of failsafe. For instance, in its initialization code, the App could test whether the certificate to use is the dummy or not, and if this is the dummy, change a visible feature of the app (e.g. put a red border around the screen, or something like that).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.