# mkcert | Filippo Valsorda | Knowledge Base | Instagit

A simple zero-config tool to make locally trusted development certificates with any names you'd like.

GitHub Stars: 58.3k

Repository: https://github.com/FiloSottile/mkcert

---

## Articles

### [How to Generate mkcert Certificates for IP Addresses and URIs: A Complete Guide](/FiloSottile/mkcert/how-to-generate-mkcert-certificates-for-ip-addresses-and-uris)

Generate mkcert certificates for IP addresses and URIs effortlessly. Learn how mkcert automatically adds Subject Alternative Name entries for seamless SSL/TLS configuration.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Change the mkcert Default Password "changeit" for PKCS12 Files](/FiloSottile/mkcert/what-is-the-default-password-changeit-for-pkcs12-files)

Learn how to change the default mkcert PKCS12 password 'changeit' by editing source code and rebuilding. Secure your certificate bundles effectively.

- Tags: how-to-guide
- Published: 2026-03-05

### [mkcert Default Key Generation Parameters: RSA 2048 vs 3072 Explained](/FiloSottile/mkcert/what-are-the-default-key-generation-parameters-for-mkcert)

Understand mkcert key generation defaults. Learn why mkcert uses RSA 2048 for leaf certificates and RSA 3072 for root CAs, and explore ECDSA alternatives.

- Tags: deep-dive
- Published: 2026-03-05

### [How to Use mkcert Certificates with Node.js Using NODE_EXTRA_CA_CERTS](/FiloSottile/mkcert/how-to-use-mkcert-certificates-with-nodejs)

Learn to use mkcert certificates with Node.js by setting the NODE_EXTRA_CA_CERTS environment variable. Trust your local development certificates easily.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Selectively Install mkcert CA into Specific Trust Stores Using TRUSTSTORES](/FiloSottile/mkcert/how-to-selectively-install-mkcert-ca-into-specific-trust-stores)

Control mkcert CA installations by setting the TRUSTSTORES environment variable. Learn to selectively install the mkcert CA into specific trust stores for enhanced security.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Manage Multiple CAs Using the CAROOT Environment Variable in mkcert](/FiloSottile/mkcert/how-to-manage-multiple-cas-using-caroot-environment-variable)

Learn to manage multiple CAs with mkcert by setting the CAROOT environment variable for isolated certificate management across projects and testing environments.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Generate S/MIME Certificates with mkcert for Email Encryption](/FiloSottile/mkcert/can-mkcert-generate-smime-certificates-for-email-addresses)

Learn how mkcert generates S/MIME certificates for email encryption automatically. Discover how to set up email encryption with mkcert effortlessly, ensuring secure communication for your email addresses.

- Tags: how-to-guide
- Published: 2026-03-05

### [Understanding the Limitations of Wildcard Certificates in mkcert](/FiloSottile/mkcert/what-are-the-limitations-of-wildcard-certificates-in-mkcert)

Discover the limitations of wildcard certificates in mkcert. Learn about single-level DNS labels, second-level patterns, and filename sanitization for filesystem compatibility.

- Tags: best-practices
- Published: 2026-03-05

### [How to Generate Certificates from CSRs with mkcert: A Complete Guide](/FiloSottile/mkcert/does-mkcert-support-generating-certificates-from-csrs)

Easily generate certificates from CSRs with mkcert. Learn how to use the -csr flag to create locally trusted development certificates signed by the mkcert root CA.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Generate PKCS12 PFX Files with mkcert for Legacy Applications](/FiloSottile/mkcert/how-to-generate-pkcs12-pfx-files-with-mkcert)

Generate PKCS12 PFX files with mkcert for legacy apps. Use the -p12 flag for P12 output compatible with Windows and Java. Rename .p12 to .pfx easily.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Generate RSA Certificates with mkcert: A Complete Guide](/FiloSottile/mkcert/how-to-generate-rsa-certificates-with-mkcert)

Learn to generate RSA certificates easily with mkcert. This guide shows how to create 2048-bit RSA certificates and 3072-bit RSA CA keys with simple commands.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Generate ECDSA Certificates with mkcert: A Complete Guide](/FiloSottile/mkcert/how-to-generate-ecdsa-certificates-with-mkcert)

Easily generate ECDSA certificates with mkcert using the -ecdsa flag. This guide shows you how to create P-256 leaf certificates with mkcert for secure local development.

- Tags: how-to-guide
- Published: 2026-03-05

### [Why Are mkcert Certificates Valid for Less Than 825 Days? Apple Compatibility Explained](/FiloSottile/mkcert/why-are-mkcert-certificates-valid-for-less-than-825-days)

Discover why mkcert certificates are valid for less than 825 days. Understand Apple's security policies and ensure seamless compatibility for your development needs.

- Tags: deep-dive
- Published: 2026-03-05

### [What Is the Certificate Expiration Policy in mkcert?](/FiloSottile/mkcert/what-is-the-certificate-expiration-policy-in-mkcert)

Discover mkcert's certificate expiration policy. Learn about end-entity certs expiring in 2 years 3 months and root CA certs in 10 years for secure local development.

- Tags: deep-dive
- Published: 2026-03-05

### [How to Use mkcert Certificates with Java Applications: A Complete keytool Integration Guide](/FiloSottile/mkcert/how-to-use-mkcert-certificates-with-java-applications)

Integrate mkcert certificates with Java applications using keytool. Easily add mkcert root CA to your trust store and generate PKCS12 bundles for seamless JVM TLS.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Add mkcert CA to Firefox Trusted Certificates on macOS and Linux](/FiloSottile/mkcert/how-to-add-mkcert-ca-to-firefox-trusted-certificates)

Easily add mkcert CA to Firefox trusted certificates on macOS and Linux. Install certutil, run mkcert -install, and restart Firefox to ensure secure local development.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Integrate mkcert CA with Linux Trust Stores (update-ca-trust/update-ca-certificates)](/FiloSottile/mkcert/how-to-integrate-mkcert-ca-with-linux-trust-stores)

Quickly integrate mkcert CA with Linux trust stores using update-ca-trust or update-ca-certificates. Learn how mkcert automatically installs system-wide for seamless local certificate management.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Integrate mkcert CA with Windows Certificate Store: A Complete Technical Guide](/FiloSottile/mkcert/how-to-integrate-mkcert-ca-with-windows-certificate-store)

Integrate mkcert CA with Windows Certificate Store seamlessly. This guide explains how mkcert automatically adds its root CA to Windows ROOT store using native CryptoAPI calls. No external tools needed.

- Tags: how-to-guide
- Published: 2026-03-05

### [How to Integrate mkcert CA with macOS Keychain: Complete Developer Guide](/FiloSottile/mkcert/how-to-integrate-mkcert-ca-with-macos-keychain)

Integrate mkcert CA with macOS Keychain to automatically trust local certificates. Follow our developer guide and run mkcert -install for seamless integration.

- Tags: how-to-guide
- Published: 2026-03-05

### [How mkcert Creates and Manages Local CA Certificates: A Deep Dive into the Source Code](/FiloSottile/mkcert/how-mkcert-creates-and-manages-local-ca-certificates)

Explore mkcert source code to understand how it generates and manages local CA certificates, signing leaf certificates and installing roots into system trust stores.

- Tags: deep-dive
- Published: 2026-03-05