I'm connecting a Rails app hosted on Heroku, to an external PostgreSQL database using SSL certificates for authentication.

This requires three files: (1)the signed certificate (2)the key (3)the root ca certificate.

The signed cert and the root cert can both be added to the git repo, but the key must be kept secure.

For passwords, we would use ENV/'Config Vars' to keep things safe .... but how do I secure the key file?

I asked Heroku themselves, but they said this was "an issue that falls outside the nature of the Heroku Support policy."

So I'm asking the experts instead