github - SSL 证书中涉及的文件是否应该保密(添加到 .gitignore)？

Question

在为我的站点设置 SSL 证书的过程中，创建了几个不同的文件，

server.csr

server.key

server.pass.key

site_name.crt

在将我的网站推送到 github 之前，应该将这些添加到 .gitignore 吗？

如果这是一个愚蠢的问题，请提前道歉。

Answer 1

Should these be added to .gitignore before pushing my site to github?

它们根本不应该在 repo 中，这意味着存储在 repo 之外。
这样:

您不需要管理 .gitignore ,

您可以将这些 key 存放在安全的地方。

GitHub 在看到 users storing keys and passwords in public repositories 后实际上不得不在 2013 年更改它的搜索功能.见 the full story .
The article包括这个报价:

The mistakes may reflect the overall education problem among software developers.

When you have expedited programs—"6 weeks and you'll be a real software developer"—to teach developing, security becomes an afterthought. And considering "90 percent of development is copying stuff you don't understand, I'd bet most of them simply don't know what id_rsa is"

2016年，这本“书”(玩笑)反射(reflect)的是:


OP补充说:

I think Heroku requires putting the files into the repo in order to run ">heroku certs:add server.crt server.key" and setup the cert.

“ Configuration and Config Vars ”是关于该主题的一个说明:

A better solution is to use environment variables, and keep the keys out of the code. On a traditional host or working locally you can set environment vars in your bashrc file. On Heroku, you use config vars.

文章“ Heroku: SSL Endpoint ”并不强制您在代码中拥有这些 key 和证书。它们可以直接在 Heroku 上生成并保存在其他任何地方以便妥善保管。只是不在 git repo 中。