filosottile/mkcert
A simple zero-config tool to make locally trusted development certificates with any names you'd like.
How mkcert is put together
mkcert is a single-binary Go CLI tool that creates a local certificate authority and issues locally-trusted development certificates with zero configuration. main.go implements the command-line entry point, flag parsing, CA loading, and hostname validation; cert.go handles certificate/key generation (RSA/ECDSA, PKCS#12); truststore_*.go files implement per-platform installation of the CA into system stores (macOS keychain via security, Linux update-ca-trust/update-ca-certificates/trust, Windows certutil), NSS/Firefox profiles via certutil, and Java keystores via keytool. Data flow: user-supplied names are validated and punycoded, the CA is loaded from or created in the CAROOT directory (~/.local/share/mkcert by default), then certificates are written to disk alongside optional .p12 bundles.
Languages
Infrastructure
Major components
CLI entry point and orchestration (main.go)
Parses flags (-install, -uninstall, -pkcs12, -ecdsa, -client, -csr, output file overrides), validates argument combinations, resolves CAROOT, loads the CA, and dispatches to install/uninstall/cert-generation flows.
CA lifecycle management
Creates, loads, installs, and uninstalls the local root CA (rootCA.pem / rootCA-key.pem) in the CAROOT directory.
Certificate generation (cert.go)
Generates leaf certificates for hostnames, IPs, emails (S/MIME), and URIs, supporting RSA/ECDSA keys, client-auth certs, CSR-based issuance, and PKCS#12 output.
Hostname validation
Validates each name as IP, email, URL, or hostname using net/mail, net/url, IDNA punycode conversion, and a hostname regexp before issuing certificates.
macOS trust store integration (truststore_darwin.go)
Installs/uninstalls the root CA in the macOS system keychain and detects Firefox/NSS on macOS.
Linux trust store integration (truststore_linux.go)
Installs the CA via update-ca-trust, update-ca-certificates, or trust depending on the distro, and locates NSS/Firefox profile directories.
Windows trust store integration (truststore_windows.go)
Uses certutil to add/remove the root CA from the Windows system store.
NSS and Java trust store integration (truststore_nss.go, truststore_java.go)
Manages CA installation into Firefox/Chrome NSS databases via certutil and Java cacerts keystores via keytool, honoring JAVA_HOME and TRUST_STORES filtering.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required