Is it ok to have self-signed certificates in source control?

Secrets -- private keys and passwords alike -- shouldn't be stored in source control. Where possible, self-signed certs should be replaced with centrally signed certs as well.

Software such as Vault facilitates distribution of secrets and most importantly rolling of them.

In this way you can setup your development machines with a level of control and stay away from the bad habit of secrets in source control because even if they are a self-signed certificate, they're still a bad habit. Things that are meant to be low value or secure unimportant things often become important later and forgotten.

Set it up right and stay with it right.


If you are just talking about the certificate, there is no cryptographic reason to not put it under source control, as certificates are designed to be public. You still should make sure you don't leak any proprietary information in the certificate metadata, like X.509 names of privileged entities.

If you think about also storing the secret key in the repository, it is just like storing a password. So in fact you created a shared "account" between all users that have access to the repository or a working copy, so all problems of shared accounts apply. The security implications depend on what the possessor of the secret key may do. If that certificate allows login into some production systems, you are doomed, while on the other extreme, if the only use for the key and certificate is in testing your product, and it is not accepted anywhere else, no harm is done. In the latter case, you might consider generating the certificate during test on the fly. There are valid points for both using a fixed test certificate/key and generating them on the fly, but this discussion is no longer related to IT security, but to source code and build management.