Scroll to navigation

MKCERT(1) User Commands MKCERT(1)


mkcert - zero-config tool to make locally trusted certificates


Usage of mkcert:

$ mkcert -install
Install the local CA in the system trust store.
$ mkcert
Generate "" and "".
$ mkcert localhost ::1
Generate "" and "".
$ mkcert "*"
Generate "" and "".
$ mkcert -uninstall
Uninstall the local CA (but do not delete it).

Advanced options:

-cert-file FILE, -key-file FILE, -p12-file FILE

Customize the output paths.


Generate a certificate for client authentication.


Generate a certificate with an ECDSA key.


Generate a ".p12" PKCS #12 file, also know as a ".pfx" file, containing certificate and key for legacy applications.

-csr CSR

Generate a certificate based on the supplied CSR. Conflicts with all other flags and arguments except -install and -cert-file.


Print the CA certificate and key storage location.
$CAROOT (environment variable)
Set the CA certificate and key storage location. (This allows maintaining multiple local CAs in parallel.)
$TRUST_STORES (environment variable)
A comma-separated list of trust stores to install the local root CA into. Options are: "system", "java" and "nss" (includes Firefox). Autodetected by default.


The full documentation for mkcert is maintained as a Texinfo manual. If the info and mkcert programs are properly installed at your site, the command

info mkcert

should give you access to the complete manual.

November 2021 mkcert