3 ms·
The devcert tool (and its corresponding devcert-cli command-line interface) is very handy for creating a local root certificate authority that you control & you
by canadaduane 6y ago
The devcert tool (and its corresponding devcert-cli command-line interface) is very handy for creating a local root certificate authority that you control & your device trusts:
https://github.com/davewasmer/devcert https://github.com/davewasmer/devcert
https://github.com/davewasmer/devcert-cli https://github.com/davewasmer/devcert-cli
Benefits include no scare-screen, and being able to switch off all of your personally-generated certs at once by revoking the root auth.
- jeroenhd 6y agoIP addresses and localhost are still exempt from these changes. For development purposes, nothing serious should change; localhost is already a secure context. I'd very much watch out for using automated tools like these. Many browsers do not check certificate revocation and this leaves your browser open to some extensive MitM attacks. If you use this, you should probably create a second profile (firefox /p to create and pick one) so your normal browsing won't be affected. In my opinion, it's easier to just type "thisisunsafe" into the warning page once if you use it for developing. If you're demoing your application, putting it on a server with a Let's Encrypt cert shouldn't be too hard either. I'm sure this has its uses, but I just can't figure out what they would be if you do not wish to take huge security risks.