README

mkcert

mkcert is a simple tool for making locally-trusted development certificates. It requires no configuration.


$ mkcert -install
Created a new local CA 💥
The local CA is now installed in the system trust store! ⚡️
The local CA is now installed in the Firefox trust store (requires browser restart)! 🦊

$ mkcert example.com ".example.com" example.test localhost 127.0.0.1 ::1

Created a new certificate valid for the following names 📜
 - "example.com"
 - ".example.com"
 - "example.test"
 - "localhost"
 - "127.0.0.1"
 - "::1"

The certificate is at "./example.com+5.pem" and the key at "./example.com+5-key.pem" ✅




Using certificates from real certificate authorities (CAs) for development can be dangerous or impossible (for hosts like example.test, localhost or 127.0.0.1), but self-signed certificates cause trust errors. Managing your own CA is the best solution, but usually involves arcane commands, specialized knowledge and manual steps.

mkcert automatically creates and installs a local CA in the system root store, and generates locally-trusted certificates. mkcert does not automatically configure servers to use the certificates, though, that's up to you.

 Installation

 Warning: the rootCA-key.pem file that mkcert automatically generates gives complete power to intercept secure requests from your machine. Do not share it.

 macOS

On macOS, use Homebrew


brew install mkcert
brew install nss  if you use Firefox


or MacPorts.


sudo port selfupdate
sudo port install mkcert
sudo port install nss  if you use Firefox


 Linux

On Linux, first install certutil.


sudo apt install libnss3-tools
    -or-
sudo yum install nss-tools
    -or-
sudo pacman -S nss
    -or-
sudo zypper install mozilla-nss-tools


Then you can install using Homebrew on Linux


brew install mkcert


or build from source (requires Go 1.13+)


git clone https://github.com/FiloSottile/mkcert && cd mkcert
go build -ldflags "-X main.Version=$(git describe --tags)"


or use the pre-built binaries.


curl -JLO "https://dl.filippo.io/mkcert/latest?for=linux/amd64"
chmod +x mkcert-v-linux-amd64
sudo cp mkcert-v-linux-amd64 /usr/local/bin/mkcert


For Arch Linux users, mkcert is available on the official Arch Linux repository.


sudo pacman -Syu mkcert


 Windows

On Windows, use Chocolatey


choco install mkcert


or use Scoop


scoop bucket add extras
scoop install mkcert


or build from source (requires Go 1.10+), or use the pre-built binaries.

If you're running into permission problems try running mkcert as an Administrator.

 Supported root stores

mkcert supports the following root stores:

 macOS system store
 Windows system store
 Linux variants that provide either
     update-ca-trust (Fedora, RHEL, CentOS) or
     update-ca-certificates (Ubuntu, Debian, OpenSUSE, SLES) or
     trust (Arch)
 Firefox (macOS and Linux only)
 Chrome and Chromium
 Java (when JAVA_HOME is set)

To only install the local root CA into a subset of them, you can set the TRUST_STORES environment va

Top issues

Discussions

Latest release

Firefox packaged in a Snap, which is the default browser of Ubuntu 22.04, is now supported ✅

Fixed a crash when a CSR doesn't have SANs 💥

Calling mkcert with no arguments only prints the help text 🤫

Pre-built binaries for windows/arm64 and darwin/arm64 🧱

Pre-built binaries are now available at stable URLs like these 🔗
https://dl.filippo.io/mkcert/latest?for=linux/amd64
https://dl.filippo.io/mkcert/v1.4.4?for=windows/arm64