Docs/local-ssl

local-ssl

Generate locally-trusted HTTPS certificates for development. Pure Rust, no OpenSSL dependency.

Installation

cargo install local-ssl

# Prerequisites (for system trust):
# macOS: (bundled)
# Linux: update-ca-certificates
# Windows: certutil

Quick start

1

Initialize CA

$ sudo local-ssl init
2

Generate cert

$ sudo local-ssl generate myapp.test
3

Test HTTPS

$ curl --cacert /etc/local-ssl/ca-cert.pem https://myapp.test/
4

Generate with SANs

$ sudo local-ssl generate api.test www.test

Commands

local-ssl initInitialize CA and install system trust
local-ssl generate <domains>Generate HTTPS certificates--output
local-ssl listList all generated certificates
local-ssl show <domain>Show certificate details
local-ssl trustReinstall CA system trust
local-ssl statusShow CA and certificate status
local-ssl check <domain>Check local cert or remote server (host:port)
local-ssl telemetry statusView telemetry settings
local-ssl telemetry enableEnable anonymous usage telemetry
local-ssl telemetry disableDisable anonymous usage telemetry

CA Management

The Certificate Authority is generated once and stored at /etc/local-ssl/. The CA certificate is valid for 10 years. Server certificates are valid for 1 year.

# Check CA status
local-ssl status

# Reinstall system trust
sudo local-ssl trust

# CA files:
#   /etc/local-ssl/ca-key.pem
#   /etc/local-ssl/ca-cert.pem
#   /etc/local-ssl/certs/<domain>/

Integration with local-dns

local-ssl pairs seamlessly with local-dns for complete local development infrastructure.

# 1. Add DNS entry
local-dns add myapp.test 127.0.0.1

# 2. Generate HTTPS cert
sudo local-ssl generate myapp.test

# 3. Access via HTTPS
curl https://myapp.test/

# 4. Your local server
node server.js --key /etc/local-ssl/certs/myapp.test/key.pem \
  --cert /etc/local-ssl/certs/myapp.test/cert.pem

Security Notes

All certificates generated by local-ssl are for local development only. The CA certificate should never be distributed or trusted outside your development machine.

The tool uses rcgen for certificate generation — a pure Rust implementation with no OpenSSL FFI dependency. Keys are stored as PEM files with 600 permissions.

GitHub

Source code, issues, and contributions:

github.com/veduket/local-ssl↗