mkcert: locally trusted development certificates — by FiloSottile

intermediatepageBSD-3-Clause

A zero-config tool that creates a local CA, installs it in your system trust stores and issues certificates for chosen hostnames, avoiding self-signed browser warnings during development. Never share the generated rootCA-key.pem.

Quick steps

mkcert -install
mkcert example.com (names may include wildcards and localhost)

Paraphrased from the source. Menus can differ by version, so check the original for full details.

Read the full article on github.com

Source: mkcert: locally trusted development certificates by FiloSottile. Licence: BSD-3-Clause.

Source reviewed: 2026-11-02
Link checked: 2026-11-02
Tested hands-on: Not by Oddbyte.Me

mkcertlocal httpsdevelopment

More in Certificates & HTTPS

Frequently Asked Questions (FAQ) — by Let's Encrypt

beginnerpage

Answers common questions: certificates are free DV only, last 90 days (renew about every 60), the private key stays on your server, wildcards require DNS-01, and requesting a cert can attract crawler traffic because of Certificate Transparency logs.

Certbot User Guide — by EFF Certbot

intermediatepage

The reference for Certbot: certonly vs installer plugins, standalone/webroot/manual/DNS validation, renewal, hooks, revocation and deletion. Read the renew and hooks sections to automate reloading your web server.

Challenge Types — by Let's Encrypt

intermediatepage

Compares HTTP-01 (file on port 80), DNS-01 (TXT record at _acme-challenge) and TLS-ALPN-01. DNS-01 is the one needed for wildcards or servers that are not publicly reachable, but it needs a DNS API and narrowly scoped credentials.