[GH-ISSUE #377] possibility to limit down the rootCA on a specific domain #248

New issue

Open

opened 2026-02-25 22:32:57 +03:00 by kerem · 4 comments

kerem commented

2026-02-25 22:32:57 +03:00

Owner

Originally created by @krtschmr on GitHub (Jun 24, 2021).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/377

we use this for our test-environments (QA testing) and distribute the certificate across the engineering team. they have to import the rootCA in order to be able to have ssl working on our test environments.
However, having a rootCA that's valid for the whole internet allows for MITM attacks within our company network (or any other an attacker has control which we would use).

In order to mitigate this, i want to limit down the rootCA to one domain only (*.our-test-company.co). Does mkcert -install provide any options on this or shall i generate my own rootCA, limited on domain, which i then place into the rootCA path?

Originally created by @krtschmr on GitHub (Jun 24, 2021). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/377 we use this for our test-environments (QA testing) and distribute the certificate across the engineering team. they have to import the rootCA in order to be able to have ssl working on our test environments. However, having a rootCA that's valid for the whole internet allows for MITM attacks within our company network (or any other an attacker has control which we would use). In order to mitigate this, i want to limit down the rootCA to one domain only (*.our-test-company.co). Does `mkcert -install` provide any options on this or shall i generate my own rootCA, limited on domain, which i then place into the rootCA path?

kerem commented

2026-02-25 22:32:57 +03:00

Author

Owner

@krtschmr commented on GitHub (Jun 24, 2021):

One way of doing it would be in this tutorial: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html

@krtschmr commented on GitHub (Jun 24, 2021): One way of doing it would be in this tutorial: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html

kerem commented

2026-02-25 22:32:57 +03:00

Author

Owner

@krtschmr commented on GitHub (Jun 24, 2021):

i see this was done in https://github.com/FiloSottile/mkcert/pull/309/files which looks fantastic to me.
shall we merge it?

@krtschmr commented on GitHub (Jun 24, 2021): i see this was done in https://github.com/FiloSottile/mkcert/pull/309/files which looks fantastic to me. shall we merge it?

kerem commented

2026-02-25 22:32:57 +03:00

Author

Owner

@nh2 commented on GitHub (Oct 18, 2024):

Duplicate of #302.

@nh2 commented on GitHub (Oct 18, 2024): Duplicate of #302.

kerem commented

2026-02-25 22:32:57 +03:00

Author

Owner

@directionless commented on GitHub (Apr 12, 2025):