Create Locally Trusted SSL Certificates with mkcert on Ubuntu 20.04

Last Updated:

In this tutorial, you will learn how to create locally trusted SSL certificates with mkcert on Ubuntu 20.04. mkcert is a simple zero-config tool that is used to make locally trusted development certificates. It automatically creates and installs a local CA in the system root store, and generates locally-trusted certificates.

Using certificates from real certificate authorities (CAs) for development can be dangerous or impossible (for hosts like localhost or, but self-signed certificates cause trust errors. Managing your own CA is the best solution, but usually involves arcane commands, specialized knowledge and manual steps, but not any more with the availability of mkcert utility.

Using mkcert to Create Locally Trusted SSL Certificates

Install Certutil on Ubuntu 20.04

As a prerequisite, you are required to install certutil, a command-line utility that can create and modify certificate and key databases before you can install mkcert utility.

sudo apt install libnss3-tools -y

Installing mkcert on Ubuntu 20.04

Once the installation of certutil is done, download the current version of mkcert pre-built binary from Github releases page.

As of this writing, the current version of mkcert is v1.4.3

So download the current version and install it as shown below

sudo cp mkcert-v1.4.3-linux-amd64 /usr/local/bin/mkcert
sudo chmod +x /usr/local/bin/mkcert

Generate Local CA on Ubuntu 20.04

Now that the mkcert utility is installed, run the command below to generate and install your local CA on Ubuntu 20.04.

mkcert -install

Sample command output;

The local CA is now installed in the system trust store! ⚡️
The local CA is now installed in the Firefox and/or Chrome/Chromium trust store (requires browser restart)! 🦊

The command creates a root CA and is stored under ~/.local/share/mkcert.

You can find the root CA path by running the command below.

mkcert -CAROOT

Listing the directory contents;

ls -1 ~/.local/share/mkcert

Create Locally Trusted SSL Certificates with mkcert

Now that you have your local CA, run the command below to generate local SSL certificates using mkcert command.

mkcert '*' localhost ::1
Sample command output;
Created a new certificate valid for the following names 📜
 - ""
 - "*"
 - "localhost"
 - ""
 - "::1"

Reminder: X.509 wildcards only go one level deep, so this won't match ℹ️

The certificate is at "./" and the key at "./" ✅

It will expire on 31 August 2023 🗓

You have the certificate and key in the current working directory;

ls -1 ./*

Enable Web Server HTTPS using the Certificates

The certificates are now installed and it is time to enable your webserver to use them for HTTPS connections.

To configure Apache to use these certificates, edit the default ssl configuration file, /etc/apache2/sites-available/default-ssl.conf and change the SSL certificate and key file to point to the locally generated cert and key file above.

See the example below. Note the certificates are in my home directory.

Be sure to replace the paths accordingly.

sudo sed -i 's#/etc/ssl/certs/ssl-cert-snakeoil.pem#/home/koromicha/; s#/etc/ssl/private/ssl-cert-snakeoil.key#/home/koromicha/' /etc/apache2/sites-available/default-ssl.conf

To verify this;

grep -E "SSLCertificateFile|SSLCertificateKeyFile" /etc/apache2/sites-available/default-ssl.conf
		#   SSLCertificateFile directive is needed.
		SSLCertificateFile	/home/koromicha/
		SSLCertificateKeyFile /home/koromicha/
		#   the referenced file can be the same as SSLCertificateFile

Enable Apache to use SSL by loading the ssl modules;

sudo a2enmod ssl
sudo a2ensite default-ssl.conf

Reload and restart Apache to activate the new configuration

sudo systemctl restart apache2

Verify Local SSL Certs generated with mkcert

Navigate to the browser and try to access your domain.

I am using local hosts file for my DNS entries.

Create Locally Trusted SSL Certificates with mkcert on Ubuntu 20.04

Enable the Certificates for Nginx Web Server

Create your web page configuration as shown below.

Replace the paths to the ceritificate and key accordingly

vim /etc/nginx/sites-available/
server {
listen 80;
listen 443 ssl;

ssl on;
ssl_certificate /home/koromicha/; 
ssl_certificate_key /home/koromicha/;

location / {
root /var/www/html/example;
index index.html;

Verify that the configuration has no error.

nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Restart Nginx

systemctl restart nginx

Navigate to the browser and test your ssl for your domain.

localhost https mkcert

Well, seems up-to that far everything is fine.

And that concludes our guide on how to use mkcert to create locally trusted SSL certificates.

More mkcert usage information.

mkcert --help

Other Tutorials

Configure Nginx with SSL/TLS certificates on CentOS 8

Monitor SSL/TLS Certificate Expiry with Prometheus and Grafana

Configure Apache with SSL/TLS Certificates on CentOS 8

Easy way to configure Filebeat-Logstash SSL/TLS Connection


We're passionate about sharing our knowledge and experiences with you through our blog. If you appreciate our efforts, consider buying us a virtual coffee. Your support keeps us motivated and enables us to continually improve, ensuring that we can provide you with the best content possible. Thank you for being a coffee-fueled champion of our work!

Photo of author
I am the Co-founder of, Linux and the whole FOSS enthusiast, Linux System Admin and a Blue Teamer who loves to share technological tips and hacks with others as a way of sharing knowledge as: "In vain have you acquired knowledge if you have not imparted it to others".

5 thoughts on “Create Locally Trusted SSL Certificates with mkcert on Ubuntu 20.04”

  1. Thanks for this article, helped me a lot. Just to make this more flexible, you can set the Certifications via host based.

    ServerName http://www.example.loc
    ServerAlias example.loc

    DocumentRoot /var/www/example.loc/public

    ServerName example.loc

    SSLEngine On
    SSLCertificateFile /home/user_dir/ssl-certs/example.loc.pem
    SSLCertificateKeyFile /home/user_dir/ssl-certs/example.loc-key.pem

    DocumentRoot /var/www/example.loc/public

    If you need additional subdomains with https, you’ve to create separate Certificates for each subdomain and also repeat the “” block for each subdomain.

  2. Great write-up! I’m really interested in learning more about generating SSL certificates locally on Ubuntu, and this blog post has provided some valuable insights. Using `mkcert` to generate certs without needing to rely on a CA is a game-changer, and I can’t wait to try it out on my own systems. Thanks for sharing!

  3. Thanks for sharing this helpful tutorial! I’m running Ubuntu 20.04 and was struggling to understand how to create locally trusted SSL certificates. Your steps were clear and easy to follow. I’ll definitely be using mkcert for my SSL certificate needs from now on.


Leave a Comment