5

I have a PEM file used only for automatic builds and tests on amazon.

My project is open source and I am keeping all information on github. If the information is sensitive, I encrypt it and still keep it on github.

Should I encrypt the pem file used for the automatic build and tests? What is the threat in case I don't?

5
  • What exactly do you use the certificate for during the build process?
    – RoraΖ
    Nov 24, 2014 at 12:32
  • @raz I use it with vagrant to create machines on amazon. Nov 24, 2014 at 13:37
  • When you say you keep it in github, is it a private repository? and Im not sure if you keep your PEM file under version control
    – Purefan
    Feb 13, 2017 at 13:51
  • @Purefan I specify in the question that my project is opensource. Feb 15, 2017 at 18:13
  • 1
    private keys, just as passwords, should not be published (they are private). What would be worse is if you actually versioned controlled your private key, for example by publishing it in an open github repository, because then its part of the history and even if you git rm the file, it is in history and part of a previous commit that someone can just checkout
    – Purefan
    Feb 16, 2017 at 9:05

2 Answers 2

1

Your PEM file may contain Private key used in your build and tests. You should safekeep PEM properly.

1

It does not matter whether it is on github or not. A private key should always be protected from eavesdropping, because by definition it is intended to be secret. Encryption is common, because it is easy to setup and use.

The only use case where encryption should not be used is for unattended batch operations, because it would lead to a recursive problem: how should you protect the key that is used to unlock the PEM key without human interaction? In that case, you rely on the OS security and make the PEM file accessible only to its owner.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.