Zero-Config HTTPS for Local Development

“It works on my machine” stops being a joke when your app only works over HTTPS — which is every app using secure cookies, service workers or third-party OAuth. Self-signed certificates get you the padlock icon with a red strike-through and a wall of warnings, which breaks the flow of testing the real thing.

The fix is mkcert: it creates a local Certificate Authority (CA), trusts it in your operating system, and then issues certificates for any domains you like — instantly trusted by your browser, with no warnings. This is the exact mechanism JengaDev uses under the hood. Here is how to do it yourself.

Step 1 — Install mkcert

Windows (Chocolatey):

choco install mkcert

Windows (Scoop):

scoop bucket add extras
scoop install mkcert

macOS (Homebrew):

brew install mkcert

Linux (Debian/Ubuntu):

sudo apt install libnss3-tools
wget https://github.com/FiloSottile/mkcert/releases/latest/download/mkcert-linux-amd64
sudo install -m 755 mkcert-linux-amd64 /usr/local/bin/mkcert

Step 2 — Create and trust the local CA

mkcert -install

This generates a private CA on your machine and adds it to your OS trust store. You will never see “Your connection is not private” for mkcert certificates again.

Step 3 — Issue a certificate for your project

Certificates are per-machine and per-domain. From your project folder:

mkcert myapp.test "*.myapp.test" localhost 127.0.0.1 ::1

You now have myapp.test+2.pem and myapp.test+2-key.pem in the folder. Notice we included localhost and 127.0.0.1 — handy if the same project runs on multiple hostnames.

Step 4 — Point your domain at localhost

Using .test domains keeps things clean: .test is reserved for testing and never resolves on the real internet. Map it to your machine in the hosts file:

127.0.0.1 myapp.test
::1       myapp.test

server {
    listen 443 ssl;
    server_name myapp.test;
    ssl_certificate     /path/to/myapp.test+2.pem;
    ssl_certificate_key /path/to/myapp.test+2-key.pem;
}

server: {
  https: {
    key:  fs.readFileSync("myapp.test+2-key.pem"),
    cert: fs.readFileSync("myapp.test+2.pem"),
  },
}