Skip to content

don't install to the nss root store by default #674

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mozkeeler wants to merge 1 commit into
base: master
Choose a base branch
from
Open

don't install to the nss root store by default #674

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ mkcert is a simple tool for making locally-trusted development certificates. It
$ mkcert -install
Created a new local CA 💥
The local CA is now installed in the system trust store! ⚡️
The local CA is now installed in the Firefox trust store (requires browser restart)! 🦊

$ mkcert example.com "*.example.com" example.test localhost 127.0.0.1 ::1

Expand Down Expand Up @@ -37,15 +36,13 @@ On macOS, use [Homebrew](https://brew.sh/)

```
brew install mkcert
brew install nss # if you use Firefox
```

or [MacPorts](https://www.macports.org/).

```
sudo port selfupdate
sudo port install mkcert
sudo port install nss # if you use Firefox
```

### Linux
Expand Down Expand Up @@ -122,7 +119,9 @@ mkcert supports the following root stores:
* Chrome and Chromium
* Java (when `JAVA_HOME` is set)

To only install the local root CA into a subset of them, you can set the `TRUST_STORES` environment variable to a comma-separated list. Options are: "system", "java" and "nss" (includes Firefox).
To only install the local root CA into a subset of them, you can set the `TRUST_STORES` environment variable to a comma-separated list. Options are: "system", "java", and "nss" (includes Firefox).

Note that Firefox version 120 and later trusts certificates added to the system root store by default on macOS and Windows, so installing to the "nss" root store should be unnecessary on these platforms.

## Advanced topics

Expand Down
5 changes: 3 additions & 2 deletions main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,8 @@ const advancedUsage = `Advanced options:
$TRUST_STORES (environment variable)
A comma-separated list of trust stores to install the local
root CA into. Options are: "system", "java" and "nss" (includes
Firefox). Autodetected by default.
Firefox). If blank, "system" and "java" are enabled by default.
"nss" is disabled by default.

`

Expand Down Expand Up @@ -345,7 +346,7 @@ func (m *mkcert) checkPlatform() bool {
func storeEnabled(name string) bool {
stores := os.Getenv("TRUST_STORES")
if stores == "" {
return true
return name != "nss"
}
for _, store := range strings.Split(stores, ",") {
if store == name {
Expand Down