Mkcert: Simple zero-config tool to make locally trusted development certificates | Hacker News Reader

Mkcert: Simple zero-config tool to make locally trusted development certificates

github.com

267 pointsthunderbong42 comments

_o/ author here! mkcert is definitely my most popular tool, and it's always a delight to see how it makes developers' lives easier and how happy they are about it <3

Something that I wonder about from time to time is how "done" is mkcert. A lot of its value is in simplicity, so I've rejected attempts to make it more of a toolkit to generate all sorts of certificates (although I see the value in being able to edit the expiration and other fields). The only thing on my TODO is splitting the trust stores out into an importable package for other tools to use. Maybe that will act as a release valve for other use cases.

In a sense, mkcert will never be done because its job is also to keep up with browser requirements for you, but that goes in waves, and not much has changed in the last couple years. (Unlike the first years of mkcert, when things were really a moving target.) Similarly, it has to keep up with new trust stores and ways to install into them, and we might be overdue for a pass of that, but these are not really new features, just maintenance.

Previously:

Mkcert: Tool for making locally-trusted development certificates — https://news.ycombinator.com/item?id=17748208 — Aug 2018 (39 comments)

Show HN: Mkcert – Valid HTTPS certificates for localhost — https://news.ycombinator.com/item?id=18842218 — Jan 2019 (118 comments)

Thanks you for making it and keeping it simple. I agree that the simplicity is what makes it great to use for localhost testing. Big fan of this tool since I found it.

No matter what I work on and how complex, mkcert is always there for my dev environment. In combination with cert-manager's CA support[0], even TLS for Kubernetes development environments is simple as it gets.

Thanks Filippo!

[0]: https://cert-manager.io/docs/configuration/ca/

Thanks for this tool! I found it when Apple started enforcing stricter requirements for certificates, and the commands I was using to create certificates at the time had become inadequate. I have since used mkcert to generate dozen of certificates for my local network, which work on any service and device.

The only drawback of mkcert is that it makes you forget the steps needed to make a certificate!

You have absolutely made the right decision in keeping things simple.

I've used this in the past and it has been very convenient! Thanks Filippo!

Having said that, nowadays I just bring up a local caddy instance and use that. Caddy can set up and use a local CA for development/testing [1]. In my case I'm using caddy on my little public-facing hobby server anyway, so it's convenient to have a similar setup in local dev. If I cared about actually getting at & directly using the certificates myself I'd probably go back to mkcert.

[1] https://caddyserver.com/docs/automatic-https#local-https

For local (GUI!) tools I find XCA (https://hohnstaedt.de/xca/) excellent. It has a few ready to fo templates out of the box, and you can make your own.

Personally, I've also had decent experiences with Keystore Explorer: https://keystore-explorer.org/

I actually wrote about using it on my blog, which has plenty of screenshots: https://blog.kronis.dev/tutorials/lets-run-our-own-ca

It's pretty good for having your own simple CA, self signed certificates or anything of the sort, as well as having a nicer interface for anything that's not one of the ACME providers (e.g. Let's Encrypt) or when you don't need CLI or automation.

Serve your local website on HTTPS with mkcert - https://news.ycombinator.com/item?id=23653455 - June 2020 (1 comment)

Show HN: Mkcert – Valid HTTPS certificates for localhost - https://news.ycombinator.com/item?id=18842218 - Jan 2019 (115 comments)

Mkcert: Tool for making locally-trusted development certificates - https://news.ycombinator.com/item?id=17748208 - Aug 2018 (38 comments)

This says it's not meant for production use.

Does anyone know of something that is meant for production use for generating in-house certificate authorities and signing certificates?

I've used scripts I've written myself that run OpenSSL commands. They get the job done, but they're not the kind of thing that fits all use cases, and they're not user-friendly.

I've tried EasyRSA which is not particularly easy either. It requires some unexpected use of environment variables, and I didn't find the documentation very clear either.

Let's Encrypt? https://letsencrypt.org/

Using an external service as a way of setting up internal-only certificates? No thanks.

It's not hard to make a CA.

Make a key for your CA, make an SSL key for your sever, sign the key with your CA and add the CA to your in-house browser/list of trusted CAs.

> add the CA to your in-house browser/list of trusted CAs.

This is the hard part. Unless it's company hardware there is absolutely no way I am installing a new root cert on my machine.

Intuitively this seems reasonable, but, as a sense check I want to put the other side: Not necessarily with the goal that you change your mind, but that you didn't end up just doing what was intuitive without weighing the options.

The public CAs are run pretty well, and they have people actually overseeing them to verify that remains so, without you lifting a finger (well, unless you'd like to help oversee them at least). In contrast a local CA is very likely to be poorly run, because it's not really anybody's actual job to do it properly, you can't justify the expense [If you're Google, then, sure, you can justify the expense but also you are not asking about this on HN] to train them, they can't afford the time and effort to do their best work.

The public CAs are almost certainly not going to lose their root private key, if bad guys do steal the root key for a CA, it'll make news and also you almost certainly aren't the target, in contrast the root key for your private CA probably lives on somebody's laptop (which can be left on a train) or a server somewhere.

There's good tooling for the public CAs. Your software might already come ready to use ACME, and if it doesn't you will find instructions pretty easily. In contrast although there are technology stacks for this stuff without the public CA context, they're not as widespread, particularly in Free Software, and you may find if you need certs for five systems that means five separate tools. Or you do it manually which sucks.

Everything already trusts the public CAs. It's not difficult to tell Mac OS, Windows or even a Linux distro to trust some root CA, but it's an extra step to be done and if you forget it may be difficult to figure out why things don't work. For some services that's enough, but if you also want BYO devices to work that's a nightmare, likewise for guest devices.

Names will almost certainly leak anyway. If your goal is to hide the fact secret-project.example.com exists, I strongly recommend instead changing it to some-codename.example.com so that you needn't care much if the name leaks.

None of the above makes mkcert a bad idea - mkcert is for development. But you should weigh this when deciding whether internal-git-server.mycorp.example should just use Let's Encrypt certificates rather than spinning up an internal only CA.

I've had my eye on [step](https://github.com/smallstep/certificates) and [step-ca](https://github.com/smallstep/certificates) for a hot minute; it's production quality and seems much more pleasant than the EasyRSA scripts. Haven't tested it but I'd recommend that as a place to start tinkering.

You could use XCA [1] for small scale deployments, or step-ca [2] for a more comprehensive setup.

[1] https://www.hohnstaedt.de/xca/

[2] https://smallstep.com/docs/step-ca

Hashicorp Vault is an obvious one. Microsoft Active Directory Certificate Service is another.

If you're looking for a service-oriented offering, maybe think about Keyfactor, Venafi ... do you already have a PKI that you need to integrate with, etc?

cfssl is what I use, usually a root + intermedia ca, and leaf certs, works really well with cert manager in kubernetes.

https://github.com/cloudflare/cfssl

Caddy is your friend here https://caddyserver.com/docs/automatic-https

We use it at our company. Also in CI. Because it's much more straightforward and everyone can understand what it does. Glad it exists.

We use this with vite-plugin-mkcert to provide https localdev with just the installation of mkcert from homebrew. Wayyyy simpler than any other method of providing localdev https.

Dumb question alert; can these certs be repurposed to sign windows binaries for running locally?

Depending on the environment, windows can be set to prohibit executing anything that isn't signed....which is annoying on a dev machine building windows executables.

> windows can be set to prohibit executing [...] on a dev machine building windows executables

lol @ "dev machine" ?!

Even if not explicitly set that way, I found that windows security can intermittently end up blocking unsigned stuff, which if anything is even more annoying than a consistent rule. Had this problem when trying to make a python gui executable.

Is this really needed for the "localhost" name? I understand the need for this because a lot of people create multiple local services with specific names other than localhost, so it would be flagged as not being secure?

It has use cases for localhost. For example, testing Secure Cookies locally that can only be transmitted over https.

Completely forgot about. Saved my day today, after struggling with crazy java limitations for 5 days.

openssl c_client -connect localhost ... is also great. xca is also nice, but mkcert is much easier to use.

I really enjoy this tool making it easier, combined with dnsmasq and nginx, to spin things up in whatever custom local tld I want with a secure and trusted development certificate

Or just use openssl, then there's no need to install Go and all its dependencies. Which Google will probably discontinue anyway.

Have you actually tried doing this? It's an absolute nightmare. I tried creating SSL test certs for my websockets implementation and just gave up because I just couldn't get them working with my libraries SSL stream implementation.

I just found this last week when setting up some local network server bits and it was just perfect. Thank you!

We use it at Pixie to easily setup certs for our self hosted users. Amazing tool.

This should be part of openssl :)

You can do this kind of thing with OpenSSL, but it's... arcane.

I have it boiled into a few shell scripts that generate the cnf files needed. OpenSSL has improved its CLI beyond the old Perl script that had long been used for running a local CA and you get fine grained control over what features you want.

It's not just arcane it's a horrible idea from an infosec perspective. Thinking about all my wonderful developers having local trusted root CAs just sitting on their hard drives is making my blood pressure skyrocket.

seriously useful tool, i've never had setting up locally trusted certs be any easier.

Support for npm, python, emacs, cygwin would be nice. Better yet run away if someone suggests a custom CA, it is not worth it.

Could you elaborate? Where is it missing support for Python? It just generates TLS certs for local use, and where would Cygwin, npm (a package manager), and Emacs (a text editor) even figure in any of this?

I guess this is mostly for generating localhost certs, that was not what I thought you needed this for. I was listing stuff that is a problem with running your own CA, so mainly if you are unlucky enough to be behind a enterprise proxy. I.e. how to import trusted certs everywhere.

I can not remember how and where you need to install these certs, but it just about finding where different applications store their trust stores. Lots of them have their own solutions.

Npm has an option in the config that allow you to choose your own ca location.

That has little to do with supporting specific languages and environments though, and more to do with those languages not have a good method to do CA installation. I have no idea about Node.js, but Python will just use the regular trust store for the OS, because it's all just OpenSSL under the hood.

Your problem isn't with mkcert and mkcert isn't missing support for anything, but with there not being a good, universal way to manage trust stores. That's an independent issue that mkcert can't fix.

Reply on news.ycombinator.com