mkcert — Zero-Config Local HTTPS Development Certificates

What it is

mkcert is a simple CLI tool that creates locally-trusted development certificates with zero configuration. It installs a local Certificate Authority in your system trust store, then generates certificates that browsers accept without warnings.

mkcert targets web developers who need HTTPS in local development for testing service workers, secure cookies, mixed content, or OAuth callbacks. It eliminates the pain of self-signed certificates and manual trust store management.

The project is actively maintained and suitable for both individual developers and teams looking to integrate it into their existing toolchain. Documentation and community support are available for onboarding.

How it saves time or tokens

Without mkcert, setting up local HTTPS involves generating a CA, creating certificates, adding the CA to multiple trust stores, and repeating this on each machine. mkcert does all of this with mkcert -install followed by mkcert localhost. No OpenSSL commands, no manual trust store edits, no browser restarts.

How to use

1. Install mkcert via Homebrew (brew install mkcert), Chocolatey, or download from GitHub releases.
2. Run mkcert -install once to create and install the local CA.
3. Run mkcert localhost 127.0.0.1 ::1 to generate certificate and key files.
4. Configure your dev server (Vite, webpack-dev-server, nginx) to use the generated .pem files.

Example

# Install mkcert and set up the local CA
brew install mkcert
mkcert -install

# Generate certificates for local development
mkcert localhost 127.0.0.1 ::1 myapp.local
# Creates: localhost+3.pem and localhost+3-key.pem

# Use with Node.js
node -e "
const https = require('https');
const fs = require('fs');
https.createServer({
  key: fs.readFileSync('localhost+3-key.pem'),
  cert: fs.readFileSync('localhost+3.pem')
}, (req, res) => res.end('Hello HTTPS')).listen(443);
"

Related on TokRepo

• AI Tools for Coding — Development tools and local environment setup utilities.
• AI Tools for Security — Security tools including certificate management and TLS configuration.

Common pitfalls

• Sharing mkcert-generated certificates across machines. The CA is local to your machine. Certificates will not be trusted on other machines unless you export and install the CA there.
• Using mkcert certificates in production. They are signed by a local CA that public browsers do not trust. Use Let's Encrypt or a commercial CA for production.
• Forgetting to run mkcert -install first. Without installing the local CA, generated certificates trigger the same browser warnings as self-signed certs.
• Not reading the changelog before upgrading. Breaking changes between versions can cause unexpected failures in production. Pin your version and review release notes.