CheatPress

mkcert Local trusted dev certs

Version 1.4.4 · source

mkcert, Postcard, light preview Light · Postcard 102 × 152 mm · PDF mkcert, Postcard, dark preview Dark · Postcard 102 × 152 mm · PDF mkcert, Postcard, ink saver preview Ink saver · Postcard 102 × 152 mm · PDF
mkcert, A5, light preview Light · A5 148 × 210 mm · PDF mkcert, A5, dark preview Dark · A5 148 × 210 mm · PDF mkcert, A5, ink saver preview Ink saver · A5 148 × 210 mm · PDF
mkcert, A4, light preview Light · A4 210 × 297 mm · PDF mkcert, A4, dark preview Dark · A4 210 × 297 mm · PDF mkcert, A4, ink saver preview Ink saver · A4 210 × 297 mm · PDF
mkcert, A4 landscape, light preview Light · A4 landscape 297 × 210 mm · PDF mkcert, A4 landscape, dark preview Dark · A4 landscape 297 × 210 mm · PDF mkcert, A4 landscape, ink saver preview Ink saver · A4 landscape 297 × 210 mm · PDF
mkcert, A3, light preview Light · A3 297 × 420 mm · PDF mkcert, A3, dark preview Dark · A3 297 × 420 mm · PDF mkcert, A3, ink saver preview Ink saver · A3 297 × 420 mm · PDF
mkcert, A3 landscape, light preview Light · A3 landscape 420 × 297 mm · PDF mkcert, A3 landscape, dark preview Dark · A3 landscape 420 × 297 mm · PDF mkcert, A3 landscape, ink saver preview Ink saver · A3 landscape 420 × 297 mm · PDF
mkcert, Letter, light preview Light · Letter 8.5 × 11 in · PDF mkcert, Letter, dark preview Dark · Letter 8.5 × 11 in · PDF mkcert, Letter, ink saver preview Ink saver · Letter 8.5 × 11 in · PDF
mkcert, Tabloid, light preview Light · Tabloid 11 × 17 in · PDF mkcert, Tabloid, dark preview Dark · Tabloid 11 × 17 in · PDF mkcert, Tabloid, ink saver preview Ink saver · Tabloid 11 × 17 in · PDF

Start here

mkcert -install
Create CA, trust it
mkcert <name> ...
Issue a certificate
mkcert localhost 127.0.0.1 ::1
Local dev cert
mkcert "*.<domain>"
Wildcard cert
mkcert -CAROOT
Where the CA lives
mkcert -cert-file <f> -key-file <f> <name>
Choose output names
mkcert -pkcs12 <name>
Also write .p12
mkcert -uninstall
Remove CA from stores

Concepts

  1. mkcert -install CA in CAROOT
  2. Trust stores system, NSS, Java
  3. Leaf cert + key your hostnames
One CA, many leaf certificates

Setup

mkcert -install
Create local CA and trust it
mkcert -uninstall
Remove CA from trust stores
Does not delete the CA files; remove the CAROOT folder for that.
mkcert -CAROOT
Print CA folder
sudo apt install libnss3-tools
Linux: Firefox/Chrome NSS support
Needs certutil before -install, or browsers will not trust the CA.
brew install mkcert nss
macOS install (nss for Firefox)
choco install mkcert
Windows install
TRUST_STORES=system,nss mkcert -install
Limit which stores are used
Values: system, java, nss. Java also needs JAVA_HOME set.

Issue certificates

mkcert <name> ...
Cert for one or more names
Output: <first-name>+<n>.pem and <first-name>+<n>-key.pem in the current directory.
mkcert example.test localhost 127.0.0.1 ::1
Hostnames plus IPs
mkcert "*.<domain>"
Wildcard certificate
mkcert -cert-file <crt> -key-file <key> <name>
Set output file names
mkcert -ecdsa <name>
Use an ECDSA key
mkcert -pkcs12 <name>
Also produce a .p12 bundle
Default password is changeit.
mkcert -p12-file <f> -pkcs12 <name>
Set .p12 output path
mkcert -client <name>
Client-authentication cert
mkcert <user>@<domain>
S/MIME cert for an email address
mkcert -csr <file>
Sign an existing CSR
Cannot be combined with names or other flags except -install and -cert-file.

Trust elsewhere

CAROOT=<dir> mkcert -install
Install a copied CA on another host
Copy only rootCA.pem there; the key is not needed to trust.
CAROOT=<dir> mkcert <name>
Use a separate CA
NODE_EXTRA_CA_CERTS="$(mkcert -CAROOT)/rootCA.pem"
Make Node.js trust the CA
$(mkcert -CAROOT)/rootCA.pem
Root cert to import on phones
iOS: install the profile, then enable full trust in settings.
JAVA_HOME=<jdk> mkcert -install
Trust CA in Java keystore

Recipes

Local HTTPS for a dev server
mkcert -installmkcert -cert-file dev.pem -key-file dev-key.pem localhost 127.0.0.1 ::1# point the server at dev.pem and dev-key.pem
nginx server block
mkcert -cert-file dev.pem -key-file dev-key.pem app.test# ssl_certificate     /path/dev.pem;# ssl_certificate_key /path/dev-key.pem;curl https://app.test
Share the CA with a teammate or VM
cp "$(mkcert -CAROOT)/rootCA.pem" ./# on the other machine, with rootCA.pem in <dir>:CAROOT=<dir> mkcert -install
Inspect the result
openssl x509 -in dev.pem -noout -subject -issuer -dates -ext subjectAltName