Basic security question) What do I do with "rootCA-key.pem" file

[ghost]

Thanks to mkcert, I've successfully setup certificates for my home server.
But now I have "rootCA-key.pem" and "rootCA.pem" file just sitting at CAROOT directory.
After basic googling "rootCA.pem" doesn't seem that important to keep it secure so I'm going to leave it there, but "rootCA-key.pem" file seems pretty important to secure it.
Do I just leave it there and just don't do any stupid things like downloading malware, or is it better to move to some sort of encrypted conatiner, can macOS keychain securely store it? If "rootCA-key.pem" isn't present in CAROOT directory due to moving to better place, does mkcert still work as before without issue?

[tigran-sargsyan-w]

rootCA-key.pem is the file that really needs protection.

rootCA.pem is the public CA certificate. It is expected to be copied to machines/devices where you want to trust certificates issued by that CA.

rootCA-key.pem, on the other hand, is the private signing key. Anyone who obtains it can create certificates trusted by every machine on which that root CA is installed.

So I would:

• never copy/share rootCA-key.pem;
• keep filesystem permissions restrictive;
• keep it on encrypted storage if the threat model warrants it;
• avoid synchronizing CAROOT through Dropbox/iCloud/Git/etc.;
• back it up only if you actually need to keep issuing certificates from the same CA.

mkcert expects the CA key as a file in its CAROOT when it needs to issue a new certificate.

If you simply move rootCA-key.pem somewhere else, existing certificates do not suddenly stop working — they were already signed, and the public root CA remains installed in the trust store.

But mkcert will no longer be able to issue new certificates from that same CA unless you make the key available again.

A clean way to store the CA elsewhere is to move/manage the CA directory and point mkcert to it with:

export CAROOT=/path/to/secure/ca-directory

when you need to issue certificates.

So yes: treat rootCA-key.pem like a real CA private key, because that is exactly what it is.