MKCERT(1)

📦 version 1.4.4, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu resolute, ubuntu stonking

✨ MKCERT(1) ✨

okay bestie, so this is the User Commands girlies, and we're talking about mkcert — the zero-config tool to make locally trusted certificates. no config files, no crying, no cap. 💅

🎀 NAME 🎀

mkcert — zero-config tool to make locally trusted certificates

like literally that's it, that's the whole vibe. she makes certs that your machine actually trusts. 🦋

🌸 DESCRIPTION 🌸

okay so here's how you use mkcert, step by step, no gatekeeping:

$ mkcert -install

Install the local CA in the system trust store. 💖

$ mkcert example.org

Generate "example.org.pem" and "example.org-key.pem". ✨

$ mkcert example.com myapp.dev localhost 127.0.0.1 ::1

Generate "example.com+4.pem" and "example.com+4-key.pem". 🔥 (yes, she counts for you, it's giving main character energy)

$ mkcert "*.example.it"

Generate "_wildcard.example.it.pem" and "_wildcard.example.it-key.pem". 🌈

$ mkcert -uninstall

Uninstall the local CA (but do not delete it). 🫶 so like, she's gone but she's not gone gone, yk?

💅 Advanced options 💅

not me dropping the advanced stuff like it's nothing. obsessed. 🎀

  • -cert-file FILE, -key-file FILE, -p12-file FILE — Customize the output paths. like you get to pick where the files go, it's your world bestie 💜
  • -client — Generate a certificate for client authentication.
  • -ecdsa — Generate a certificate with an ECDSA key.
  • -pkcs12 — Generate a ".p12" PKCS #12 file, also know as a ".pfx" file, containing certificate and key for legacy applications. (yes the manpage really says "know as", we don't fix that, we respect her 😭)
  • -csr CSR — Generate a certificate based on the supplied CSR. Conflicts with all other flags and arguments except -install and -cert-file. so do NOT mix her with the other girlies, she's picky fr fr 💀
  • -CAROOT — Print the CA certificate and key storage location.
  • $CAROOT (environment variable) — Set the CA certificate and key storage location. (This allows maintaining multiple local CAs in parallel.) lowkey iconic, you can run a whole friend group of CAs 🧚
  • $TRUST_STORES (environment variable) — A comma-separated list of trust stores to install the local root CA into. Options are: "system", "java" and "nss" (includes Firefox). Autodetected by default. 🌸

👑 SEE ALSO 👑

The full documentation for mkcert is maintained as a Texinfo manual. If the info and mkcert programs are properly installed at your site, the command

info mkcert

should give you access to the complete manual. go read it, iykyk 📖✨

okay that's the whole page, mwah 💖 this one's from mkcert, November 2021, and it lives in section 1 of the manual. slay, periodt, go make some certs bestie 🎀🦋

📦 where this page comes from