Mkcert
Dev tools
certificate generator
SHOW HN2019
How HN took it
8 positive, 18 neutral or asking, 0 mixed, 13 critical, out of 39 comments about the project. Thread score -0.05.
Idea: 7 for, 5 againstPrivacy: 0 for, 4 againstExecution: 0 for, 2 againstDesign: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful for testing HTTPS locally, e.g. OAuth and WebRTC work
From 4 comments
I've always worked around low-level C++ so never got the need to understand how HTTPS certificates work... until I needed to test some code for WebRTC applications. This tool was…
j1elo on HNThis is great, will definitely check this out. I just struggled for hours following multiple blog posts and howtos to setup https locally, because I was trying to test Facebook…
jypepin on HNI love this tool a lot. It's super helpful. I usually can get away with this but some tool really require it. For example, I implement google oauth flow recently and they have a…
kureikain on HNWell this is timely. I spent several hours today trying to get local https working. I needed it because iOS Safari will only let you make getUserMedia (WebRTC) requests for the…
anderspitman on HN
Objections
Storing the CA private key user-readable weakens the trust boundary
From 2 comments
I don't understand why you made the CA private key user-readable. On my system, modifying the trust anchors requires root privileges. mkcert undoes this boundary by opening a…
regecks on HNAm I wrong to think this opens a gaping security hole? Adding a new root CA means anyone who gets their hands on the keys (which are openly available to the user of mkcert) gets…
ricardobeat on HN
Installing a root CA on the system is a security risk
From 2 comments
Am I wrong to think this opens a gaping security hole? Adding a new root CA means anyone who gets their hands on the keys (which are openly available to the user of mkcert) gets…
ricardobeat on HNFor local web dev/testing most tools generate test temp certificates automatically or it's easy to get them, so the only issue is using it in production e.g. for communicating…
buybackoff on HN
Release binaries are not signed
From 1 comment
I have one slight concern, and one snark. The slight concern is, I'm concerned that most of the pre-built binaries (the "pre-built binaries link" goes to…
CaliforniaKarl on HN
Requests
Option to install to specific trust stores only
From 1 comment
Cool. I wish there was an option to specify which trust stores to install to, for example only to Firefox's. The current default is to install in system (requires sudo), Chrome…
aorth on HN
Name-constrained root CA option
From 2 comments
It would be nice if the root could be generated with name constraints so losing it isn't quite so catastrophic.
tedunangst on HNFor local web dev/testing most tools generate test temp certificates automatically or it's easy to get them, so the only issue is using it in production e.g. for communicating…
buybackoff on HN
Questions
Why use HTTPS on localhost at all
From 1 comment
what is the benefit of having a certificate in localhost? I don't really see the point if you are on your local machine
psonama on HN
Does it work with Docker containers
From 1 comment
Will it work inside a Docker container and my browser in my bare metal?
alexandernst on HN
Alternatives named
Let's Encrypt with a real domain resolving to 127.0.0.1
From 2 comments
Do you really want a valid certificate for localhost? I can get a valid certificate for development by simply getting a valid certificate for localhost.example.com on my server…
speleding on HNI'm almost 99% certain that everyone who's this concerned - already has a domain. (or they can get a free domain from something like .tk - as it really does not matter since this…
sonaltr on HN
chrome://flags allow-insecure-localhost
From 1 comment
Private CA is a good route if you plan on setting up a long standing internal only test server and devices. OTOH if you just want to access https://localhost on your PC things…
zamadatix on HN
XCA certificate tool
From 2 comments
If you need to keep a database of certs, checkout XCA.
exabrial on HNFor local web dev/testing most tools generate test temp certificates automatically or it's easy to get them, so the only issue is using it in production e.g. for communicating…
buybackoff on HN