# How to Selectively Install mkcert CA into Specific Trust Stores Using TRUSTSTORES

> Control mkcert CA installations by setting the TRUSTSTORES environment variable. Learn to selectively install the mkcert CA into specific trust stores for enhanced security.

- Repository: [Filippo Valsorda/mkcert](https://github.com/FiloSottile/mkcert)
- Tags: how-to-guide
- Published: 2026-03-05

---

**Set the `TRUSTSTORES` environment variable to a comma-separated list of store identifiers (e.g., `system,nss,java`) before running `mkcert -install` to restrict CA installation to only those trust stores.**

The `mkcert` tool by FiloSottile automatically installs its generated root CA into every supported trust store on your platform. For environments requiring granular control, the `TRUSTSTORES` environment variable allows you to selectively install the mkcert CA into specific trust stores, bypassing default behavior that targets all available stores.

## Understanding the TRUSTSTORES Environment Variable

By default, `mkcert -install` attempts to add the root CA to every trust store implemented for the current operating system. This includes the system-wide CA bundle, browser-specific NSS databases, the macOS Keychain, the Windows certificate store, and the Java `cacerts` keystore.

The `TRUSTSTORES` variable accepts a comma-separated list of identifiers that limits installation to explicitly named stores. Valid identifiers include:

- `system` – The operating system's global CA certificate bundle (e.g., `/etc/ca-certificates` on Linux).
- `nss` – The NSS (Network Security Services) databases used by Firefox, Chrome, and Chromium.
- `darwin` – The macOS system Keychain (`/Library/Keychains/System.keychain`).
- `windows` – The Windows "Trusted Root Certification Authorities" store.
- `java` – The Java runtime `cacerts` file (typically `$JAVA_HOME/lib/security/cacerts`).
- `none` – Skip all automatic installation; useful when manually distributing the root CA.

## How TRUSTSTORES Works Under the Hood

In [`main.go`](https://github.com/FiloSottile/mkcert/blob/main/main.go), mkcert parses the `TRUSTSTORES` environment variable into a slice of strings named `trustStores`. This slice is then passed to the installation logic.

Each platform-specific implementation checks for its identifier within this slice before executing. For example, in [`truststore_linux.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_linux.go), the `installPlatform()` function contains:

```go
if !contains(trustStores, "system") {
    return false
}
// Proceed with installing to /usr/local/share/ca-certificates/...

```

Similarly, [`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go) guards the NSS installation with:

```go
if !contains(trustStores, "nss") {
    return false
}

```

The `contains()` helper function iterates over the `trustStores` slice to determine if the specific identifier is present. If `TRUSTSTORES` is unset, mkcert defaults to an empty slice, which the code interprets as "install to all supported stores."

## Practical Examples

### Install Only to System and NSS Stores

To add the CA to the Linux system bundle and Firefox/Chrome databases while skipping Java and other stores:

```bash
export TRUSTSTORES=system,nss
mkcert -install

```

### Install Only to macOS Keychain

On macOS, to restrict installation to the system Keychain and ignore NSS or Java stores:

```bash
export TRUSTSTORES=darwin
mkcert -install

```

### Install Only to Java Keystore

For environments where only Java applications need to trust the CA:

```bash
export JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
export TRUSTSTORES=java
mkcert -install

```

### Skip All Automatic Installation

To generate the CA without modifying any trust stores (useful for manual distribution):

```bash
export TRUSTSTORES=none
mkcert -install

```

After running with `TRUSTSTORES=none`, manually copy the root CA file (printed to stdout) to your desired locations.

## Platform-Specific Store Identifiers

The following table maps each `TRUSTSTORES` identifier to its implementation file and target location:

| Identifier | Platform | Implementation File | Target Location |
|------------|----------|---------------------|-----------------|
| `system` | Linux | [`truststore_linux.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_linux.go) | `/usr/local/share/ca-certificates/` or `/etc/ca-certificates/` |
| `nss` | Linux, macOS, Windows | [`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go) | `~/.pki/nssdb` and browser profiles |
| `darwin` | macOS | [`truststore_darwin.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_darwin.go) | `/Library/Keychains/System.keychain` |
| `windows` | Windows | [`truststore_windows.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_windows.go) | `Cert:\LocalMachine\Root` |
| `java` | Cross-platform | [`truststore_java.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_java.go) | `$JAVA_HOME/lib/security/cacerts` |

## Summary

- The `TRUSTSTORES` environment variable accepts a comma-separated list of identifiers to limit which trust stores receive the mkcert root CA.
- Valid identifiers are `system`, `nss`, `darwin`, `windows`, `java`, and `none`.
- When `TRUSTSTORES` is unset, mkcert installs to all supported stores for the current platform.
- Each platform-specific implementation in `truststore_*.go` checks for its identifier in the parsed list before executing installation logic.

## Frequently Asked Questions

### What happens if I set TRUSTSTORES to an invalid identifier?

If you provide an identifier not recognized by mkcert (e.g., `TRUSTSTORES=invalid`), the tool simply ignores it. No error is thrown, but the unrecognized store will not be installed. The valid identifiers are hardcoded in the platform-specific files as `system`, `nss`, `darwin`, `windows`, `java`, and `none`.

### Can I use TRUSTSTORES on Windows to skip the system store?

Yes. On Windows, setting `TRUSTSTORES=nss` will install the CA only into the NSS databases used by Firefox and Chrome, leaving the Windows "Trusted Root Certification Authorities" store untouched. Conversely, `TRUSTSTORES=windows` restricts installation to the system store only.

### Does TRUSTSTORES affect the uninstall command?

Yes. The `TRUSTSTORES` variable applies symmetrically to both installation and removal. When you run `mkcert -uninstall`, only the stores listed in `TRUSTSTORES` will have the CA removed. If you originally installed with `TRUSTSTORES=java`, you should use the same variable when uninstalling to ensure complete removal.

### How do I verify which stores were actually modified?

mkcert prints a success message for each store it updates. When `TRUSTSTORES` is set, you will see output only for the specified identifiers. For example, with `TRUSTSTORES=nss`, the console will indicate installation into the NSS database but will not mention the system store or Java keystore. You can also verify manually by checking the respective store locations listed in the platform-specific implementation files.