I'm creating an authorisation service, which does signing using a key.
For local development I was randomly generating a key on application start-up.
Now I'm deploying to the cloud (currently going with AWS), I'm refactoring this approach to be more robust / persistent.
The current idea I have is to generate some keys and dump these into environment variables - where the PRODUCTION private key would need to be handled with care / protected.
Because they'd be in environment variables, I'd use the PEM format.
At startup, I'd now load the keys from environment variables such as
APPLICATION_SIGNING_KEY_PUBLIC/PRIVATE, parse the base-64 encoded bits and process the X509 thingy into
Private/PublicKeys in memory.
Is this standard - or even acceptable? Are there any holes in this design?