How do you get trusted HTTPS on localhost with a local CA?

Create a local certificate authority, trust it on your machine, and issue development certificates from it. The mkcert tool does this in two commands, installing a local CA in your system trust store and issuing certificates for names like localhost without a public CA or browser warnings.

Why not a public certificate or a self-signed one

Public CAs cannot issue certificates for names such as localhost or 127.0.0.1, and the mkcert project notes that using real CA certificates for development can be dangerous or impossible for hosts like those. Plain self-signed certificates cause trust errors. Running your own CA solves both, but the manual steps are fiddly. See also when a self-signed certificate is safe.

Steps

1. Install the tool with your package manager (Homebrew, Chocolatey, Scoop and others are supported). Install the NSS tools too if you use Firefox.
2. Create and trust the local CA:

mkcert -install

3. Issue a certificate for the names you need:

mkcert example.test localhost 127.0.0.1 ::1

4. mkcert writes a certificate file and a key file. Point your dev server at them. It does not configure servers for you.
5. Restart the browser if prompted, since the Firefox store needs it.

What it actually changes

The local CA is placed in your system root store, and in the Firefox, Chrome and Chromium stores where supported, plus Java when JAVA_HOME is set. Any certificate that CA signs is then trusted on that machine. That is the useful part and the risk.

The rule that matters

The project warns that the rootCA-key.pem file it generates gives complete power to intercept secure requests from your machine, and should not be shared. Treat it like a production signing key:

• Do not commit it or copy it to teammates or containers.
• Do not install your local root on shared or CI machines.
• Each developer should create their own.
• Remove the local CA when you no longer need it.

Containers and other runtimes

Runtimes with their own trust list will not trust it automatically. Use the per runtime steps in trusting a private CA in Node, Python, Java and curl, and install the CA certificate alone, never the key.

Tips for a team

• Put the install steps in your README, and say clearly that the CA is for development.
• Keep generated certificate and key files out of version control with an ignore rule.
• Use a name that ends in .test or use localhost so you never collide with a real domain.
• If a browser still warns, check that you restarted it and that the name you typed is in the certificate.

When to stop using it

Local CA certificates are for development. For anything other people reach, use a public CA with automated renewal, tested first in staging.

Where Safeguard fits

Safeguard scans dependencies and SBOMs for known vulnerabilities, including those in the TLS and crypto libraries your projects pull in, and you can try it with the free scan at gold.safeguard.sh/scan.

Quick check

Sources

• mkcert project README

Last reviewed: 19 October 2026.