otty / apps

All apps/mkcert

mkcert

A simple zero-config tool to make locally trusted development certificates with any names you'd like.

Runs as mkcert|macOS, Linux, Windows|github.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

mkcert in your home directory Every rule on this page, by file

· rootCA.pem Sync

· rootCA-key.pem Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/mkcert/otty.tomlThe file this page is generated from

id = "mkcert"

name = "mkcert"

homepage = "https://github.com/FiloSottile/mkcert"

description = "A simple zero-config tool to make locally trusted development certificates with any names you'd like."

executables = ["mkcert"]

[dotfiles]

# main.go, getCAROOT(): $CAROOT wins outright, and otherwise the base directory

# is %LocalAppData% on Windows, $HOME/Library/Application Support on macOS, and

# $XDG_DATA_HOME (else $HOME/.local/share) on other Unixes, with "mkcert"

# joined onto it. Those three are the one location [dataHome] names. The file

# names are the constants beside it: `const rootName = "rootCA.pem"` and

# `const rootKeyName = "rootCA-key.pem"`. The README says the same from the

# outside: "The CA certificate and its key are stored in an application data

# folder in the user home."

paths = ["[dataHome]/mkcert/rootCA.pem"]

exclude = []

# The README's warning, first paragraph: "the rootCA-key.pem file that mkcert

# automatically generates gives complete power to intercept secure requests

# from your machine. Do not share it." It is the private key of a CA the

# machine trusts, so it is a credential end to end; rootCA.pem, the public

# certificate above, is what you install in another trust store and carries no

# secret.

secret = ["[dataHome]/mkcert/rootCA-key.pem"]

# mkcert reads the CA on each run and exits.

side_effect = false

# No machine_lines: neither file is line-oriented configuration.

[commands]

format = 1

label = "Issue a local certificate"

description = "Create a locally-trusted development certificate for one or more names. Installing the local CA (-install) and -csr are left out. Options must come before the names."

quality = "ai-draft"

parser = { end_of_options = "--", interleave = "permute", long_equals = false, short_attached = false, short_bundles = false }

[[commands.source]]

id = "readme"

kind = "manual"

url = "https://github.com/FiloSottile/mkcert/blob/master/README.md"

revision = "master"

evidence = """$ mkcert example.com "*.example.com" example.test localhost 127.0.0.1 ::1

-cert-file FILE, -key-file FILE, -p12-file FILE

Customize the output paths.

-client

Generate a certificate for client authentication.

-ecdsa

Generate a certificate with an ECDSA key.

-pkcs12

Generate a ".p12" PKCS #12 file, also know as a ".pfx" file,

> **Note:** You _must_ place these options before the domain names list."""

[[commands.field]]

id = "cert_file"

label = "Certificate output file"

type = "path"

option = ["-cert-file"]

path = { kind = "file", role = "output" }

effect = "overwrite"

sources = ["readme"]

[[commands.field]]

id = "key_file"

label = "Key output file"

type = "path"

option = ["-key-file"]

path = { kind = "file", role = "output" }

effect = "overwrite"

sources = ["readme"]

[[commands.field]]

id = "p12_file"

label = "PKCS #12 output file"

type = "path"

option = ["-p12-file"]

path = { kind = "file", role = "output" }

effect = "overwrite"

sources = ["readme"]

[[commands.field]]

id = "client"

label = "Client authentication certificate"

type = "boolean"

option = ["-client"]

sources = ["readme"]

[[commands.field]]

id = "ecdsa"

label = "ECDSA key"

type = "boolean"

option = ["-ecdsa"]

sources = ["readme"]

[[commands.field]]

id = "pkcs12"

label = "Also write a .p12 / .pfx file"

type = "boolean"

option = ["-pkcs12"]

sources = ["readme"]

[[commands.field]]

id = "names"

label = "Domains, IPs or emails"

description = "For example example.com, *.example.com, localhost, 127.0.0.1, ::1."

type = "string"

position = 0

multiple = true

sources = ["readme"]

[[commands.task]]

id = "localhost"

label = "Certificate for localhost"

fields = ["names"]

required = ["names"]

set = { names = ["localhost", "127.0.0.1", "::1"] }

[[commands.task]]

id = "named_files"

label = "Certificate with named output files"

fields = ["cert_file", "key_file", "names"]

required = ["cert_file", "key_file", "names"]

[[commands.group]]

id = "basic"

label = "Basic"

fields = ["names", "cert_file", "key_file"]

[[commands.group]]

id = "advanced"

label = "Advanced"

fields = ["client", "ecdsa", "pkcs12", "p12_file"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/mkcert. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps the credential file out.