Can I safely save my private key on public build servers?

Question

This is a technical question on comprehension:

When I want a cloud server (e.g. GitHub Actions, Azure DevOps, or GitLab CI/CD) to build and publish an app to any of the app stores ... isn't it necessary then that I upload my private key to these servers' key vault, so they can sign my app on my behalf?

Isn't that concept a bit risky?

I mean, I was taught to let my private keys never leave my machines.

What if I accidentally misconfigure the security settings on the uploaded key? What if some black hat gets hold of the key and abuses it? I mean, with each build process, the private key is getting copied from the vault to the build runner, usually residing somewhere else.

What are the techniques used to ensure that private keys are kept safely on a public server? Is there an official audit performed on these departments?

Should I rather use different Authenticode certificates for each of the above providers? Or will a single certificate be resilient enough?

I couldn't find a technical discussion on this question, only marketing docs. Has this security concern been scientifically scrutinized?

Answer 1

It is safe to use certificates in Azure DevOps, Azure DevOps encrypts the certificate and then uses it in the build pipeline.

We could use Azure Key Vault to protect encryption keys and secrets like certificates, connection strings, and passwords in the cloud. You could refer this doc for more details.

We could also save the certificate file in the Library->Secure Files, if someone want to access or use it, he need enough permission.

I found some sample to use certificate in the Azure DevOps Service, you could check it.   If you are using SSL certificate thumbprint, you could save it in the variable and then set the variable to Secret via the “lock” icon at the end of the row.

If you are using PFX certificate, you could refer to this doc.

Update1

GitHub action

We could save the certificate here in the GitHub, GitHub also encrypts the certificate, we could not get the value after save the variable in the Secrets, and we will get *** when print the Secrets value in the log.