[GH-ISSUE #337] minimize CA root certificate lifetime #219

Open
opened 2026-02-25 22:32:53 +03:00 by kerem · 2 comments
Owner

Originally created by @Amel1010 on GitHub (Feb 10, 2021).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/337

I have a problem on safari browser with ios 13 and 14 devices. the rootCA.pem is installed and exists under trusted certificates on ios device but it still not valid on safari!!

after seeing some replies on the net , certain recommand to minimise the lifetime of the certificate to maximum 825 days.
Is it possible with mkcert certificate ? if yes wich release contains this configuration ?

Originally created by @Amel1010 on GitHub (Feb 10, 2021). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/337 I have a problem on safari browser with ios 13 and 14 devices. the rootCA.pem is installed and exists under trusted certificates on ios device but it still not valid on safari!! after seeing some replies on the net , certain recommand to minimise the lifetime of the certificate to maximum 825 days. Is it possible with mkcert certificate ? if yes wich release contains this configuration ?
Author
Owner

@FiloSottile commented on GitHub (Feb 10, 2021):

Latest mkcert already limits the lifetime of the website certificate to within the iOS limits. The limits don't apply to the lifetime of the root CA. If you are having issues, update to the latest mkcert and then regenerate the website certificate.

<!-- gh-comment-id:776884820 --> @FiloSottile commented on GitHub (Feb 10, 2021): Latest mkcert already limits the lifetime of the website certificate to within the iOS limits. The limits don't apply to the lifetime of the root CA. If you are having issues, update to the latest mkcert and then regenerate the website certificate.
Author
Owner

@xzxiaoshan commented on GitHub (Dec 12, 2024):

Latest mkcert already limits the lifetime of the website certificate to within the iOS limits. The limits don't apply to the lifetime of the root CA. If you are having issues, update to the latest mkcert and then regenerate the website certificate.

Android also has other duration issues, and the best solution should be to provide parameters when creating certificates to set the validity period (days)

<!-- gh-comment-id:2538630923 --> @xzxiaoshan commented on GitHub (Dec 12, 2024): > Latest mkcert already limits the lifetime of the website certificate to within the iOS limits. The limits don't apply to the lifetime of the root CA. If you are having issues, update to the latest mkcert and then regenerate the website certificate. Android also has other duration issues, and the best solution should be to provide parameters when creating certificates to set the validity period (days)
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/mkcert#219
No description provided.