mkcert(1)
mkcert is a simple tool for making locally-trusted development certificates with no configuration.
Synopsis
mkcert [options] [domain ...]Description
mkcert automatically creates and installs a local CA (Certificate Authority) in your system's trust store, then generates TLS certificates signed by that CA. This eliminates browser warnings for HTTPS development without complex configuration.
On first run, mkcert generates a private key and certificate for a local CA, installing it in your system's root certificate store. Subsequent runs generate domain-specific certificates signed by this local CA. It works on macOS, Linux, and Windows.
Generated certificates are saved as domain.pem (certificate) and domain-key.pem (private key) in the current directory by default.
Common options
| Flag | What it does |
|---|---|
-install | Create and install the local CA (run this first). Creates ~/.local/share/mkcert/ on Linux. |
-uninstall | Remove the local CA from your system's trust store and delete the CA key. |
-cert-file FILE | Save the certificate to a custom filename instead of domain.pem. |
-key-file FILE | Save the private key to a custom filename instead of domain-key.pem. |
-p12 FILE | Create a PKCS#12 (.p12) bundle instead of separate PEM files. |
-pkcs12 FILE | Alias for -p12; creates a PKCS#12 bundle. |
-client | Generate a client certificate for mTLS instead of a server certificate. |
-ecdsa | Use ECDSA instead of RSA for the private key (smaller, faster). |
-csr FILE | Generate a certificate from a Certificate Signing Request file. |
-CAROOT | Print the path to the local CA root directory and exit. |
Examples
Install mkcert's local CA into your system trust store. Run this once before generating certificates.
mkcert -installGenerate a certificate for example.com and www.example.com, creating example.com.pem and example.com-key.pem.
mkcert example.com www.example.comCreate a certificate for localhost and IP addresses with custom filenames.
mkcert -cert-file cert.pem -key-file key.pem localhost 127.0.0.1 ::1Generate an ECDSA certificate for api.local with custom output filenames.
mkcert -ecdsa -cert-file server.crt -key-file server.key api.localCreate a client certificate for mutual TLS authentication.
mkcert -client -cert-file client.crt -key-file client.keyPrint the CA root directory path and view the local CA certificate and key files.
echo $CAROOT && ls $CAROOTRemove the local CA from system trust store and delete it completely.
mkcert -uninstall