What does HackerNews think of mkcert?

A simple zero-config tool to make locally trusted development certificates with any names you'd like.

Language: Go

#2 in Chrome
#2 in Firefox
#1 in HTTP
#1 in iOS
#4 in Linux
#3 in macOS
#1 in Windows
My project, getlocalcert.net[1] may be the one you're thinking of.

Since I'm also building in this space, I'll give my perspective. Local certificate generation is complicated. If you spend the time, you can figure it out, but it's begging for a simpler solution. You can use tools like mkcert[2] for anything that's local to your machine. However, if you're already using ACME in production, maybe you'd prefer to use ACME locally? I think that's what Anchor offers, a unified approach.

There's a couple references in the Anchor blog about solving the distribution problem by building better tooling[3]. I'm eager to learn more, that's a tough nut to crack. My theory for getlocalcert is that the distribution problem is too difficult (for me) to solve, so I layer the tool on top of Let's Encrypt certificates instead. The end result for both tools is a trusted TLS certificate issued via ACME automation.

1. https://news.ycombinator.com/item?id=36674224

2. https://github.com/FiloSottile/mkcert

3. https://blog.anchor.dev/the-acme-gap-introducing-anchor-part...

Not sure if this works for Windows, but the author knows what he is doing and his technique seems fairly well thought out.

https://github.com/FiloSottile/mkcert

Looks like step-ca/step-cli [1] and mkcert [2] have been mentioned. Another related tool is XCA [3] - a gui tool to manage CAs and server/client TLS certificates. It takes off some of the tedium in using openssl cli directly. It also stores the certs and keys in an encrypted database. It doesn't solve the problem of getting the root CA certificate into the system store or of hosting the revocation list. I use XCA to create and store the root CA. Intermediate CAs signed with it are passed to other issuers like vault and step-issuer.

[1] https://smallstep.com/docs/step-ca/

[2] https://github.com/FiloSottile/mkcert

[3] https://hohnstaedt.de/xca/

If you absolutely need a hostname that is not "localhost" you should still configure your own host record and use a utility like mkcert.[1]

Most of the time, you really shouldn't need this, and your local HTTPS development should just require:

    mkcert -install
    mkcert localhost
In the directory of your app, etc.

If you're deploying private applications, these records should exist in your intranet DNS resolver instead.

[1]: https://github.com/FiloSottile/mkcert

> if you're developing software you should probably be running without any addons like uBlock enabled to prevent surprises in production for your non-uBlock users.

It seems to me there's a higher risk that uBlock blocks something and breaks something than uBlock making something work that wouldn't for people not having it. I once had a filter block something called /share/ or share.js, fortunately I noticed during the development. I definitely prefer having it enabled while developing.

> Besides that, you can't get HTTPS for these domains (without the mess of a custom CA and even then you'll run into CT issues)

Indeed. I recently had to do this and found mkcert [1] which makes it very easy to do. But it's overkill for most situations.

[1] https://github.com/FiloSottile/mkcert

I've not used this directly, but it may be useful: https://github.com/FiloSottile/mkcert

    mkcert is a simple tool for making locally-trusted development certificates. It requires no configuration.

    Using certificates from real certificate authorities (CAs) for development can be dangerous or impossible (for hosts like example.test, localhost or 127.0.0.1), but self-signed certificates cause trust errors. Managing your own CA is the best solution, but usually involves arcane commands, specialized knowledge and manual steps.

    mkcert automatically creates and installs a local CA in the system root store, and generates locally-trusted certificates. mkcert does not automatically configure servers to use the certificates, though, that's up to you.
This is the same author than mkcert, a great tool that for me is the one stop to make custom certificates for development. It already embeds all knowledge about how modern web browsers expect certs to be in order to work with them, so I don't have to track all the latest whims of each one. Thank you a lot for it!!

https://github.com/FiloSottile/mkcert

This is not true, you can set your host to trust a self signed certificate without much difficulty. Check out this tool for example https://github.com/FiloSottile/mkcert (prev discussion at https://news.ycombinator.com/item?id=17748208)
For a public facing computer, yes, for a private one, not so much[1].

I use mkcert[2] for this but it's still fiddly.

[1] https://letsencrypt.org/docs/certificates-for-localhost/

[2] https://github.com/FiloSottile/mkcert

You don't need let's encrypt for a dev environment, you can use something like https://github.com/FiloSottile/mkcert and run Caddy locally to reverse proxy to whatever you need for development.
Nice! In the past, I've tried to use Let's Encrypt with ESXi, but didn't see a clear and simple way with Let's Encrypt (and that itself might be overkill)... as I just needed it to admin my own servers, I decided to use https://github.com/FiloSottile/mkcert for that. I posted what I did in https://henvic.dev/posts/homelab/
Filippo Valsorda, from the Go security team, created mkcert some time ago → https://github.com/FiloSottile/mkcert which makes this process much easier. I setup a home laboratory for several HTTPS websites and it all works as expected without too much hassle.
I was curious about this because the release notes don't mention changing the behavior of HTTPS for localhost. I set up a local test and http://mytest.localhost works without having to add an entry to /etc/hosts, but https://mytest.localhost with a self-signed TLS certificate will still raise a SEC_ERROR_UNKNOWN_ISSUER error. You still need to ignore those or install your own root CA with something like https://github.com/FiloSottile/mkcert for that to work seamlessly.
I started using mkcert for this. It's trivially easy to use and fixes all the weird quirks of http vs https:

https://blog.filippo.io/mkcert-valid-https-certificates-for-...

https://github.com/FiloSottile/mkcert

I use mkcert [1] with great success - it's easy to setup locally trusted certs which I load onto my router and other devices.

[1]: https://github.com/FiloSottile/mkcert

Instead of using hacky fragile methods , use

https://github.com/FiloSottile/mkcert

to automate setting up local CA and making it trusted.

So this is a self-signed TLS certificate. Perhaps pair the CSR with mkcert[1], it will be even more useful (without seeing the warning messages in browsers.) to be used locally.

[1]: https://github.com/FiloSottile/mkcert

If you would prefer to listen to TLS directly, or don't want to use Docker, a great alternative is mkcert: https://github.com/FiloSottile/mkcert

It automates creating a self-signed certificate and having it trusted in your local cert stores. I've always missed something when doing it by hand, so it's a great automation tool.

If you own a domain, you can add a subdomain that points to the local network IP, and get Let's Encrypt to give you a certificate using the dns-01 validation method (which doesn't require Let's Encrypt to actually access the IP address in the A record).

This is clearly more complicated than ideal, but it should work.

Edit: You can also use a custom CA root certificate, which can be installed on iOS etc. mkcert is a good starting point:

https://github.com/FiloSottile/mkcert

mkcert[1] is probably the easiest way to generate root certificate and leaf certificate(s). Then you can use a proxy like Squid to intercept the traffic[2]. You’d also need a local DNS server to point hosts like fonts.googleapis.com to your own web server.

https://github.com/FiloSottile/mkcert

https://turbofuture.com/internet/Intercepting-HTTPS-Traffic-...

[Edit: Now that I think of it, I’m not sure if Squid is really required...]

I appreciate and welcome this requirement from Apple.

Some time ago I built something I call “Network Blackhole”.

The project intercepts HTTP traffic from applications that I installed in either my MacBook or iPhone. An excellent example of this is Crashlytics [1], Segment [2], and Sentry [3], which are among a list of popular web services that many developers use to report bugs and crashes in their software, and the famous Google Analytics, which I hope I don’t need to explain what it is used for.

With the help of Little Snitch [4] a popular network monitor for macOS, I detect when an app tries to connect to one of these services, or similar. Then I execute a tool written in Go like so: “blackhole example.com” which does the following:

1. Inserts domain into /etc/hosts

2. Create an HTTP web server (in Go)

3. Adds a match-all endpoint to the server

4. Creates an SSL certificate with mkcert [5]

5. Creates an Nginx virtual-host for the server

6. ???

7. Profit

In the end, and after 1-2 minutes, I have all the traffic to that domain gracefully redirected to a black hole, reducing the amount of data that I leak to 3rd-party websites.

However, don’t get me wrong, I understand the purpose of these services, I haven’t said they are evil or anything like that. I would probably use them myself if I had to, but I certainly would add an alert to ask for explicit consent from the user to send this information to a service that I won’t even have control over. If one of them leaks my customer’s data, I will be the only one facing the consequences.

I hope I don’t have to add another domain to my network black hole anymore.

[1] https://crashlytics.com/

[2] https://segment.com/

[3] https://sentry.io/

[4] https://help.obdev.at/littlesnitch/

[5] https://github.com/FiloSottile/mkcert

This is important.

Chrome finally stopped looking at the Common Name field, and I'm hoping to fade out support in the next few versions of Go. You can already test your systems in 1.11 with GODEBUG=x509ignoreCN=1. Use SANs.

This was one of the motives to create mkcert: https://github.com/FiloSottile/mkcert

Good ideas are rarely unique, as they usually solve a common problem. I recently built something similar:

https://github.com/FiloSottile/mkcert

It's in pure Go instead of using OpenSSL, and it works with Windows, macOS and Firefox, too.

https://github.com/FiloSottile/mkcert

Still self-signed, but generates a CA that gets added to your browser. It is all pretty seamless.