Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a server certificate is published to Github, a la:


is that necessarily a bad thing? Is there ever a legitimate reason to do this?

I ask because of a recent wave of attention Github has gotten since allowing users to search for certain things as .ssh/id.rsa and the like in public repositories.

Also, server certificates are involved in the https protocol, but honestly I'm having trouble determining if they are generally regarded as sensitive information.

share|improve this question

If its just a certificate there is not problem, as these only contain the public key. The problem is if the private key is publicised as is the case with for example id.rsa

share|improve this answer

I can think of an easy legitimate reason: suppose I write a program to do an offline version of the SSL Labs server test. A good test suite for that program would include various certificates with different problems and some configuration to use them for testing. E.g. it checks for the Debian weak key problem, so you'd want a certificate with a Debian weak key (perhaps for the domain

Of course, test certificates are not the same as real signed certs from a proper CA. (For testing purposes you'd use a testing CA). I would imagine that the major CAs have revoked the certificates whose private keys were available on github.

(Incidentally, if anyone knows of a repository of test certs, feel free to leave a comment...)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.