How to Selectively Install mkcert CA into Specific Trust Stores Using TRUSTSTORES

Set the TRUSTSTORES environment variable to a comma-separated list of store identifiers (e.g., system,nss,java) before running mkcert -install to restrict CA installation to only those trust stores.

The mkcert tool by FiloSottile automatically installs its generated root CA into every supported trust store on your platform. For environments requiring granular control, the TRUSTSTORES environment variable allows you to selectively install the mkcert CA into specific trust stores, bypassing default behavior that targets all available stores.

Understanding the TRUSTSTORES Environment Variable

By default, mkcert -install attempts to add the root CA to every trust store implemented for the current operating system. This includes the system-wide CA bundle, browser-specific NSS databases, the macOS Keychain, the Windows certificate store, and the Java cacerts keystore.

The TRUSTSTORES variable accepts a comma-separated list of identifiers that limits installation to explicitly named stores. Valid identifiers include:

• system – The operating system's global CA certificate bundle (e.g., /etc/ca-certificates on Linux).
• nss – The NSS (Network Security Services) databases used by Firefox, Chrome, and Chromium.
• darwin – The macOS system Keychain (/Library/Keychains/System.keychain).
• windows – The Windows "Trusted Root Certification Authorities" store.
• java – The Java runtime cacerts file (typically $JAVA_HOME/lib/security/cacerts).
• none – Skip all automatic installation; useful when manually distributing the root CA.

How TRUSTSTORES Works Under the Hood

In main.go, mkcert parses the TRUSTSTORES environment variable into a slice of strings named trustStores. This slice is then passed to the installation logic.

Each platform-specific implementation checks for its identifier within this slice before executing. For example, in truststore_linux.go, the installPlatform() function contains:

if !contains(trustStores, "system") {
    return false
}
// Proceed with installing to /usr/local/share/ca-certificates/...

Similarly, truststore_nss.go guards the NSS installation with:

if !contains(trustStores, "nss") {
    return false
}

The contains() helper function iterates over the trustStores slice to determine if the specific identifier is present. If TRUSTSTORES is unset, mkcert defaults to an empty slice, which the code interprets as "install to all supported stores."

Practical Examples

Install Only to System and NSS Stores

To add the CA to the Linux system bundle and Firefox/Chrome databases while skipping Java and other stores:

export TRUSTSTORES=system,nss
mkcert -install

Install Only to macOS Keychain

On macOS, to restrict installation to the system Keychain and ignore NSS or Java stores:

export TRUSTSTORES=darwin
mkcert -install

Install Only to Java Keystore

For environments where only Java applications need to trust the CA:

export JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
export TRUSTSTORES=java
mkcert -install

Skip All Automatic Installation

To generate the CA without modifying any trust stores (useful for manual distribution):

export TRUSTSTORES=none
mkcert -install

After running with TRUSTSTORES=none, manually copy the root CA file (printed to stdout) to your desired locations.

Platform-Specific Store Identifiers

The following table maps each TRUSTSTORES identifier to its implementation file and target location:

Identifier	Platform	Implementation File	Target Location
system	Linux	truststore_linux.go	/usr/local/share/ca-certificates/ or /etc/ca-certificates/
nss	Linux, macOS, Windows	truststore_nss.go	~/.pki/nssdb and browser profiles
darwin	macOS	truststore_darwin.go	/Library/Keychains/System.keychain
windows	Windows	truststore_windows.go	Cert:\LocalMachine\Root
java	Cross-platform	truststore_java.go	$JAVA_HOME/lib/security/cacerts

Summary

• The TRUSTSTORES environment variable accepts a comma-separated list of identifiers to limit which trust stores receive the mkcert root CA.
• Valid identifiers are system, nss, darwin, windows, java, and none.
• When TRUSTSTORES is unset, mkcert installs to all supported stores for the current platform.
• Each platform-specific implementation in truststore_*.go checks for its identifier in the parsed list before executing installation logic.

Frequently Asked Questions

What happens if I set TRUSTSTORES to an invalid identifier?

If you provide an identifier not recognized by mkcert (e.g., TRUSTSTORES=invalid), the tool simply ignores it. No error is thrown, but the unrecognized store will not be installed. The valid identifiers are hardcoded in the platform-specific files as system, nss, darwin, windows, java, and none.

Can I use TRUSTSTORES on Windows to skip the system store?

Yes. On Windows, setting TRUSTSTORES=nss will install the CA only into the NSS databases used by Firefox and Chrome, leaving the Windows "Trusted Root Certification Authorities" store untouched. Conversely, TRUSTSTORES=windows restricts installation to the system store only.

Does TRUSTSTORES affect the uninstall command?

Yes. The TRUSTSTORES variable applies symmetrically to both installation and removal. When you run mkcert -uninstall, only the stores listed in TRUSTSTORES will have the CA removed. If you originally installed with TRUSTSTORES=java, you should use the same variable when uninstalling to ensure complete removal.

How do I verify which stores were actually modified?

mkcert prints a success message for each store it updates. When TRUSTSTORES is set, you will see output only for the specified identifiers. For example, with TRUSTSTORES=nss, the console will indicate installation into the NSS database but will not mention the system store or Java keystore. You can also verify manually by checking the respective store locations listed in the platform-specific implementation files.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}