Create Locally Trusted SSL Certificates with mkcert on Ubuntu 18.04

Last Updated:

Hello folks, welcome to this very tutorial on how to create locally trusted SSL certificates with mkcert on Ubuntu 18.04. mkcert is a simple zero-config tool that is used to make locally trusted development certificates. It automatically creates and installs a local CA in the system root store, and generates locally-trusted certificates.

Creating Locally Trusted SSL Certificates with mkcert

Installing mkcert on Ubuntu

As a prerequisite, you are required to install certutil, a command-line utility that can create and modify certificate and key databases before you can install mkcert utility.

sudo apt install libnss3-tools -y

Once the installation of certutil is done, download the current version of mkcert pre-built binary from Github releases page.

As of this writing, the current version of mkcert is v1.4.3

So download the current version and install it as shown below

sudo cp mkcert-v1.4.3-linux-amd64 /usr/local/bin/mkcert
sudo chmod +x /usr/local/bin/mkcert

Generate Local CA on Ubuntu

Now that the mkcert utility is installed, run the command below to generate your local CA.

mkcert -install
The local CA is now installed in the system trust store! ⚡️
The local CA is now installed in the Firefox and/or Chrome/Chromium trust store (requires browser restart)! 🦊

The root CA is stored under #HOME/.local/share/mkcert.

You can print the location directory of the root CA path by running the command below.

mkcert -CAROOT

If you encounter the error:

ERROR: no Firefox and/or Chrome/Chromium security databases found

Just launch the browsers and re-run the install command.

Creating Locally Trusted SSL Certificates with mkcert

Now that you have your local CA, run the command below to generate local SSL certificates using mkcert command.

mkcert '*' localhost ::1

Sample command output;

Created a new certificate valid for the following names 📜
 - ""
 - "*"
 - "localhost"
 - ""
 - "::1"

Reminder: X.509 wildcards only go one level deep, so this won't match ℹ️

The certificate is at "./" and the key at "./" ✅

It will expire on 31 August 2023 🗓

You have the certificate and key in the current working directory;

ls -1 ./*

Enable Web Server HTTPS using the Certificates

The certificates are now installed and it is time to enable your webserver to use them for HTTPS connections.

To configure Apache to use these certificates, edit the default ssl configuration file, /etc/apache2/sites-available/default-ssl.conf and change the SSL certificate and key file to point to the locally generated cert and key file above.

See the example below. Note the certificates are in my home directory.

Be sure to replace the paths accordingly.

sudo sed -i 's#/etc/ssl/certs/ssl-cert-snakeoil.pem#/home/koromicha/; s#/etc/ssl/private/ssl-cert-snakeoil.key#/home/koromicha/' /etc/apache2/sites-available/default-ssl.conf

To verify this;

grep -E "SSLCertificateFile|SSLCertificateKeyFile" /etc/apache2/sites-available/default-ssl.conf
		#   SSLCertificateFile directive is needed.
		SSLCertificateFile	/home/koromicha/
		SSLCertificateKeyFile /home/koromicha/
		#   the referenced file can be the same as SSLCertificateFile

Enable Apache to use SSL by loading the ssl modules;

sudo a2enmod ssl
sudo a2ensite default-ssl.conf

Reload and restart Apache to activate the new configuration

sudo systemctl restart apache2

Verify Local SSL Certs generated with mkcert

Navigate to the browser and try to access your domain.

I am using local hosts file for my DNS entries.

Create Locally Trusted SSL Certificates with mkcert on Ubuntu 18.04

Enable the Certificates for Nginx Web Server

Create your web page configuration as shown below.

Replace the paths to the ceritificate and key accordingly

vim /etc/nginx/sites-available/

server {
listen 80;
listen 443 ssl;

ssl on;
ssl_certificate /home/koromicha/; 
ssl_certificate_key /home/koromicha/;

location / {
root /var/www/html/example;
index index.html;

Verify that the configuration has no error.

nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Restart Nginx

systemctl restart nginx

Navigate to the browser and test your ssl for your domain.

localhost https mkcert

Well, seems up-to that far everything is fine.

And that concludes our guide on how to create locally trusted SSL certificates with mkcert on Ubuntu 18.04.

More mkcert usage information.

mkcert --help

Other Tutorials

Configure Nginx with SSL/TLS certificates on CentOS 8

Monitor SSL/TLS Certificate Expiry with Prometheus and Grafana

Configure Apache with SSL/TLS Certificates on CentOS 8

Easy way to configure Filebeat-Logstash SSL/TLS Connection


We're passionate about sharing our knowledge and experiences with you through our blog. If you appreciate our efforts, consider buying us a virtual coffee. Your support keeps us motivated and enables us to continually improve, ensuring that we can provide you with the best content possible. Thank you for being a coffee-fueled champion of our work!

Photo of author
I am the Co-founder of, Linux and the whole FOSS enthusiast, Linux System Admin and a Blue Teamer who loves to share technological tips and hacks with others as a way of sharing knowledge as: "In vain have you acquired knowledge if you have not imparted it to others".

2 thoughts on “Create Locally Trusted SSL Certificates with mkcert on Ubuntu 18.04”

  1. Thanks for the article.
    I successfully walked through all steps, but my browser writes “Certificate invalid”.
    I use Chrome 90 on Ubuntu 20.04


Leave a Comment