How to Change the mkcert Default Password "changeit" for PKCS12 Files

The mkcert tool hardcodes the legacy password "changeit" for both PKCS12 certificate bundles and Java keystore operations, requiring you to edit the source code in cert.go and truststore_java.go and rebuild the binary to use a custom password.

When generating PKCS12 (.p12) files with the --pkcs12 flag or installing certificates into Java truststores, the popular TLS development tool mkcert (FiloSottile/mkcert) uses a default password that dates back to early Java conventions. Understanding where this password is embedded and how to modify it is essential for security-conscious development workflows or environments with strict password policies.

Where the Default Password "changeit" Is Defined

The password "changeit" appears in two critical locations within the mkcert codebase, both chosen for backward compatibility with legacy tools that expect this historic default.

PKCS12 Bundle Generation in cert.go

In cert.go, the pkcs12.Encode function creates the PKCS12 bundle when you use the --pkcs12 option. The source explicitly passes "changeit" as the final argument to encode the private key and certificate chain:

pfxData, err := pkcs12.Encode(rand.Reader, priv, domainCert,
    []*x509.Certificate{m.caCert}, "changeit")

This line (approximately line 25) hardcodes the password directly into the bundle generation call, meaning every .p12 file produced by the standard mkcert binary uses this identical passphrase.

Java Keystore Operations in truststore_java.go

In truststore_java.go, mkcert manages the Java cacerts keystore for system-wide trust installation. The password is defined as a constant string variable around line 28:

storePass string = "changeit"

This variable feeds into keytool commands via the -storepass flag when installing or removing certificates from the Java truststore, ensuring compatibility with default Java keystore configurations.

How to Change the mkcert PKCS12 Password

Because mkcert does not expose command-line flags for password customization, you must modify the source and compile a custom binary. Follow these steps to implement a secure, custom password:

1. Clone the repository and navigate to the source root.

2. Modify cert.go (around line 25) to replace "changeit" with your desired password string variable.

3. Update truststore_java.go (around line 28) to change the storePass constant to match your new password (or set a different one for Java operations).

4. Rebuild the binary using Go:

go build -o mkcert .

5. Verify the new binary generates PKCS12 files with your custom password by inspecting the output with OpenSSL:

openssl pkcs12 -in test.p12 -info -noout

Code Examples for Modifying the Password

Here are the specific code changes required in each file to replace the default "changeit" with a custom password such as "mySecretPwd123".

Updating cert.go

Change the hardcoded string in the pkcs12.Encode call:

// Before (default behavior)
pfxData, err := pkcs12.Encode(rand.Reader, priv, domainCert,
    []*x509.Certificate{m.caCert}, "changeit")

// After (custom password)
customPass := "mySecretPwd123"
pfxData, err := pkcs12.Encode(rand.Reader, priv, domainCert,
    []*x509.Certificate{m.caCert}, customPass)

Updating truststore_java.go

Replace the storePass constant definition:

// Before (default behavior)
storePass string = "changeit"

// After (custom password)
storePass string = "mySecretPwd123"

Both files must be saved before running go build to ensure consistency across PKCS12 generation and Java keystore operations.

Important Considerations

Changing the default password affects only future certificate operations. Existing .p12 files generated with the original mkcert binary still use "changeit" as their password. To secure previously created bundles, you must either regenerate them with your custom mkcert build or use OpenSSL to re-export them with new encryption.

Additionally, if you distribute your custom mkcert binary to team members, ensure everyone updates simultaneously when working with shared Java keystores, as mismatched passwords between the tool and existing keystores will cause keytool authentication failures.

Summary

• mkcert hardcodes "changeit" as the password in cert.go for PKCS12 bundles and in truststore_java.go for Java keystore operations.
• The password is passed directly to pkcs12.Encode() and the keytool -storepass flag for legacy compatibility.
• To use a custom password, edit the source code in both files and rebuild with go build.
• Existing certificates retain the original password and require regeneration to update.

Frequently Asked Questions

Why does mkcert use "changeit" as the default password?

The password "changeit" is the historic default for Java keystores and many legacy certificate tools. mkcert maintains this default to ensure seamless integration with older Java applications and development environments that expect this specific passphrase when importing certificates.

Can I change the PKCS12 password without rebuilding mkcert?

No. Because the password is hardcoded as a string literal in the source files rather than exposed as a configuration flag or environment variable, you must modify cert.go and truststore_java.go and compile a new binary to use a different password for PKCS12 generation.

Will changing the password break my existing Java keystore installations?

Changing the password in your mkcert binary does not automatically update existing Java keystores that were already configured with the old password. If you previously installed certificates using "changeit", your new binary may fail to remove or update those entries unless you manually specify the original password or reset the keystore entirely.

Does mkcert support different passwords for PKCS12 files versus Java keystores?

Yes. While the default implementation uses "changeit" for both, you can set different values when modifying the source. In cert.go, set one password variable for pkcs12.Encode(), and in truststore_java.go, set a different value for the storePass constant, allowing independent passwords for certificate bundles versus Java truststore operations.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}