5

I have a PEM file used only for automatic builds and tests on amazon.

My project is open source and I am keeping all information on github. If the information is sensitive, I encrypt it and still keep it on github.

Should I encrypt the pem file used for the automatic build and tests? What is the threat in case I don't?

Improve this question
5
  • What exactly do you use the certificate for during the build process?
    – RoraΖ
    Commented Nov 24, 2014 at 12:32
  • @raz I use it with vagrant to create machines on amazon.
    – guy mograbi
    Commented Nov 24, 2014 at 13:37
  • When you say you keep it in github, is it a private repository? and Im not sure if you keep your PEM file under version control
    – Purefan
    Commented Feb 13, 2017 at 13:51
  • @Purefan I specify in the question that my project is opensource.
    – guy mograbi
    Commented Feb 15, 2017 at 18:13
  • 1
    private keys, just as passwords, should not be published (they are private). What would be worse is if you actually versioned controlled your private key, for example by publishing it in an open github repository, because then its part of the history and even if you git rm the file, it is in history and part of a previous commit that someone can just checkout
    – Purefan
    Commented Feb 16, 2017 at 9:05

2 Answers 2

Reset to default
1

Your PEM file may contain Private key used in your build and tests. You should safekeep PEM properly.

Improve this answer
1

It does not matter whether it is on github or not. A private key should always be protected from eavesdropping, because by definition it is intended to be secret. Encryption is common, because it is easy to setup and use.

The only use case where encryption should not be used is for unattended batch operations, because it would lead to a recursive problem: how should you protect the key that is used to unlock the PEM key without human interaction? In that case, you rely on the OS security and make the PEM file accessible only to its owner.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .