My local site needs SSL: how to get trusted HTTPS in development

Sooner or later a local project says no: the payment SDK refuses to load, a cookie marked Secure never sticks, the service worker won’t register, or an OAuth provider rejects your http:// callback. You need HTTPS, locally, without the red warning page.

Why “just use a self-signed certificate” doesn’t work

A self-signed certificate encrypts the connection, but your browser has no reason to believe it, so it shows “Your connection is not private”. Clicking through works for you, but:

Browsers still treat the page as not secure for some APIs.
Fetch calls, websockets and service workers from the page may fail.
Tools like Node, cURL and PHP’s HTTP clients refuse the connection unless you disable verification (please don’t).

The fix: a local certificate authority

Instead of trusting each certificate, you trust one certificate authority (CA) that lives only on your computer. That CA then issues a certificate for every local domain. Because your system trusts the CA, every certificate it signs is trusted too: no warnings, in any browser that uses the system store.

This is how tools like mkcert work, and it’s built into LampRabit.

HTTPS in LampRabit, in two clicks

LampRabit creates its own local CA the first time you need it.
On the Sites page, click Trust certificate and confirm. Windows asks once; on macOS it uses your login keychain; on Linux it asks for your password once and adds the CA to the system store.

From then on, every site gets a certificate for its domain and its sub-domains, renewed automatically. HTTPS is on by default for new sites and can be switched off per site.

https://shop.test        ✓ trusted
https://api.shop.test    ✓ trusted
https://dashboard.test   ✓ trusted (a Next.js dev server, proxied)

Node.js dev servers get HTTPS too: LampRabit terminates TLS at the web server and proxies to the dev server’s port, so you don’t configure certificates in Vite or Next.js at all. See How to replace localhost:3000.

Browser notes

Chrome, Edge, Brave, Safari use the system store: they work right after Trust certificate (restart the browser if it was open).
Firefox on Windows and macOS: open about:config, set security.enterprise_roots.enabled to true, restart.
Linux: Chrome and Firefox keep their own lists. Install certutil (sudo apt install libnss3-tools, or nss-tools on Fedora) and LampRabit updates them too.

HTTPS for other people

A local CA is trusted on your machine only. To show a site to someone else over HTTPS, use a tunnel: it comes with a real public certificate. See How to share your local website.

Doing it without LampRabit

With mkcert: mkcert -install once, then mkcert shop.test "*.shop.test" per site, and point your web server’s SSL virtual host at the generated files. It works well; you just repeat it for each project and keep the web server config in sync.

Want HTTPS on every project without thinking about it? Download LampRabit.

Frequently asked questions

Is a local certificate authority safe?

It's created on your computer and its private key stays there. It can only issue certificates your own machine trusts. Removing it (LampRabit's uninstall does) removes that trust.

Why does Firefox still warn after I trusted the certificate?

Firefox keeps its own certificate list on Windows and macOS. Set security.enterprise_roots.enabled to true in about:config and restart Firefox. On Linux, LampRabit updates Firefox's and Chrome's lists when certutil is installed.

Can I turn HTTPS off for one site?

Yes. In LampRabit, HTTPS is a per-site switch, and there's a global default for new sites.