-1

In a software library, I wrote, large parts of the code use x509 certificates for various puprposes like signing documents digitally.

Is there a best practice for storing test certificates used for the unit tests? Should they be stored in git/the same versioning system where the code is?

  • A certificate is not secret like a private key, so no security issues arise. – amon Feb 28 at 12:54
  • Some certificates are used along with their private keys for signing documents. So, they do have private keys, but in my case for test purposes. – Bahaa Feb 28 at 12:58
  • 1
    Then it may be useful to run your own CA (not very complicated, just a couple of OpenSSL command line steps). You can then create certificates that are not trusted outside of your tests. This requires that your system can import the CA root certificate temporarily. Do not let the system trust the test CA permanently, as that would be a Lenovo/Superfish style vulnerability. – amon Feb 28 at 13:07
3

Certificates are small. And there is no problem with security if they are only used for testing.

So I see no problem storing them in source control.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.