How to Generate RSA Certificates with mkcert: A Complete Guide

mkcert generates 2048-bit RSA certificates by default when you run mkcert <hostname>, using 3072-bit RSA keys for its root CA, with no additional flags required.

mkcert is a zero-configuration tool that creates locally-trusted development certificates. When you generate RSA certificates with mkcert, the tool handles key generation, CA signing, and trust store installation automatically. This guide explains the default RSA behavior, implementation details from the source code, and practical workflows for development environments.

Default RSA Key Generation in mkcert

mkcert uses RSA as its default cryptographic algorithm unless explicitly overridden. The implementation in cert.go hardcodes specific bit lengths for different certificate types.

Leaf Certificate RSA Keys (2048-bit)

When you request a certificate for a specific hostname, mkcert generates a 2048-bit RSA key pair for the leaf certificate. In cert.go, the generateKey function calls rsa.GenerateKey(rand.Reader, 2048) at lines 55-57 to create the private key. This key length balances security and performance for local development scenarios.

Root CA RSA Keys (3072-bit)

The root Certificate Authority that mkcert installs on your system uses a stronger 3072-bit RSA key. In the same generateKey function (lines 70-73), mkcert calls rsa.GenerateKey(rand.Reader, 3072) when creating the CA certificate. This provides additional security for the trust anchor that signs all your development certificates.

How to Generate RSA Certificates with mkcert (Step-by-Step)

The standard workflow produces RSA certificates without requiring algorithm-specific flags.

Install the Local CA

Before generating certificates, install the mkcert root CA into your system trust store and browser trust stores:

mkcert -install

This command creates the 3072-bit RSA root CA and configures your operating system, Firefox, and Java (if present) to trust certificates signed by this authority.

Generate RSA Certificates for Hostnames

Create 2048-bit RSA certificates for your development domains:

mkcert example.com localhost 127.0.0.1 ::1

This command produces two files in the current directory:

• example.com+4.pem — The leaf certificate (RSA 2048-bit)
• example.com+4-key.pem — The corresponding private key

The +4 suffix indicates that four hostnames are included in the Subject Alternative Name (SAN) extension.

Customize Output File Names

Specify custom filenames while maintaining RSA generation:

mkcert -cert-file mycert.pem -key-file mykey.pem example.test

This creates mycert.pem and mykey.pem with standard 2048-bit RSA keys.

Generate PKCS#12 Bundles (RSA)

For Windows or IIS development, create a PKCS#12 bundle containing the RSA certificate and key:

mkcert -pkcs12 example.com

This produces example.com.p12 encrypted with the default password changeit. The bundle contains the same 2048-bit RSA key pair in a format suitable for Windows certificate stores.

Understanding the -ecdsa Flag (Non-RSA Alternative)

mkcert supports exactly one algorithm flag that deviates from the RSA default. Adding -ecdsa forces the tool to generate ECDSA P-256 keys instead of RSA:

mkcert -ecdsa example.com

This creates certificates using the elliptic curve secp256r1 (P-256) rather than 2048-bit RSA. The generateKey function in cert.go implements this branch at lines 66-69, checking the -ecdsa flag before falling back to the RSA generation at lines 70-73.

Modifying RSA Key Sizes in the Source Code

If your security policy requires different RSA key lengths, you must modify the source code. The generateKey function in cert.go hardcodes the bit lengths:

• Line 55: rsa.GenerateKey(rand.Reader, 2048) for leaf certificates
• Line 70: rsa.GenerateKey(rand.Reader, 3072) for the root CA

Changing these values and recompiling mkcert allows custom key sizes, though this requires maintaining a fork since no CLI flags expose these parameters.

Summary

• mkcert generates RSA certificates by default using 2048-bit keys for leaf certificates and 3072-bit keys for the root CA.
• No flags are required for RSA generation; simply run mkcert <hostname> to create certificates.
• The -ecdsa flag is the only algorithm switch, forcing ECDSA P-256 instead of RSA.
• Key sizes are hardcoded in cert.go and can only be changed by modifying the source and recompiling.
• Output formats include PEM files (default) and PKCS#12 bundles (via -pkcs12).

Frequently Asked Questions

Does mkcert use RSA or ECDSA by default?

mkcert uses RSA by default. When you run mkcert without algorithm flags, it generates 2048-bit RSA keys for leaf certificates and 3072-bit RSA keys for the root CA. You must explicitly add the -ecdsa flag to generate ECDSA P-256 keys instead.

What key size does mkcert use for RSA certificates?

mkcert uses 2048-bit RSA keys for leaf certificates (the ones you generate for your hostnames) and 3072-bit RSA keys for the root Certificate Authority. These values are hardcoded in the generateKey function in cert.go at lines 55 and 70 respectively.

Can I change the RSA key size without editing source code?

No, you cannot change the RSA key size via command-line flags. The bit lengths (2048 for leaf, 3072 for root) are constants in the source code. To use different key sizes, you must modify the rsa.GenerateKey calls in cert.go and recompile mkcert from source.

How do I generate a PKCS#12 file with mkcert?

Use the -pkcs12 flag followed by your hostnames: mkcert -pkcs12 example.com. This creates a .p12 file containing the RSA certificate and private key, encrypted with the default password changeit. This format is useful for importing certificates into Windows certificate stores or IIS.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}