mkcert

To trust mkcert certificates on mobile devices, you must manually install the rootCA.pem file (found via mkcert -CAROOT).

iOS

1. Transfer rootCA.pem to the device (AirDrop, email, or HTTP server).
2. Open the file.
3. Go to Settings > Profile Downloaded to install the profile.
4. Enable full trust for the certificate in settings.

Android

1. Install the CA.
2. Enable user roots in the development build of your app.

Node.js does not use the system root store. To make it trust mkcert certificates, set the NODE_EXTRA_CA_CERTS environment variable to point to the rootCA.pem file located in your mkcert CA root directory.

export NODE_EXTRA_CA_CERTS="$(mkcert -CAROOT)/rootCA.pem"

To make your locally-generated certificates trusted by your operating system and browsers, run the -install command. This creates a new local CA and installs it into the system trust store and Firefox (if NSS is installed).

Warning: The generated rootCA-key.pem file gives complete power to intercept secure requests from your machine. Do not share it.

mkcert -install

mkcert generates locally-trusted certificates by using a local Certificate Authority (CA). When you request a certificate for specific hosts, mkcert:

1. Loads or creates a local CA (root certificate and private key).
2. Generates a new private key for the certificate (RSA 2048 by default, or ECDSA if requested).
3. Creates an X.509 certificate template including the requested hosts as DNS names, IP addresses, email addresses, or URIs.
4. Signs the certificate using the local CA.
5. Saves the resulting certificate and key to disk.

Certificates are valid for 2 years and 3 months to ensure compatibility with Apple's maximum certificate lifetime limits.

By default, mkcert installs the CA into the system store, Firefox, Chrome, and Java. You can restrict this by setting the TRUST_STORES environment variable to a comma-separated list of the following options:

• system
• java
• nss (includes Firefox)

To generate certificates for specific hostnames, IP addresses, or wildcards, pass the names as arguments to mkcert.

• For a single domain: mkcert example.org (outputs example.org.pem and example.org-key.pem).
• For multiple domains/IPs: mkcert example.com myapp.dev localhost 127.0.0.1 (outputs a combined certificate like example.com+4.pem).
• For wildcards: mkcert "*.example.it" (outputs _wildcard.example.it.pem).

$ mkcert example.org
$ mkcert example.com myapp.dev localhost 127.0.0.1 ::1
$ mkcert "*.example.it"

To make your locally generated certificates trusted by your operating system and browsers, run mkcert -install. This command attempts to install the local CA into the system trust store, NSS trust stores (used by Firefox), and the Java trust store.

$ mkcert -install

To remove the local CA from the system trust stores without deleting the CA files themselves, use the -uninstall flag.

$ mkcert -uninstall

If one of the names provided to mkcert is an email address, it will automatically generate an S/MIME certificate.

mkcert filippo@example.com

Generate certificates for specific domains, wildcards, or IP addresses by passing them as arguments to mkcert. The tool will output a .pem certificate file and a -key.pem private key file in the current directory.

mkcert example.com "*.example.com" example.test localhost 127.0.0.1 ::1

By default, mkcert attempts to install the CA into all supported stores. You can restrict this by setting the TRUST_STORES environment variable to a comma-separated list of stores.

Supported values:

• system: The operating system's trust store.
• java: The Java trust store.
• nss: The NSS trust store (used by Firefox).

# Only install into the system and NSS stores
$ export TRUST_STORES=system,nss
$ mkcert -install