[GH-ISSUE #630] `mkcert -csr` cannot be mixed with `-client` — most likely a bug due to presence of checks for `-client` in code #341

New issue

Open

opened 2026-02-25 22:33:08 +03:00 by kerem · 0 comments

kerem commented

2026-02-25 22:33:08 +03:00

Owner

Originally created by @vikanezrimaya on GitHub (Apr 20, 2025).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/630

Environment

Operating system (including version): NixOS 25.05.20250418.2a76610 (Warbler)
mkcert version (from mkcert -version): v1.4.4
Server (where the certificate is loaded): n/a
Client (e.g. browser, CLI tool, or script): n/a

What you did

mkcert -client -csr ./vsh-csr.pem -cert-file ./vsh.pem

What went wrong

ERROR: can only combine -csr with -install and -cert-file

Additional info

main() checks that -client and -csr are not passed together
makeCertFromCSR() checks client flag, which is always false because of the check above
Suggestion: relax check in main() to allow passing -client to mkcert -csr invocations and enable this code path

Originally created by @vikanezrimaya on GitHub (Apr 20, 2025). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/630 ## Environment * Operating system (including version): `NixOS 25.05.20250418.2a76610 (Warbler)` * mkcert version (from `mkcert -version`): `v1.4.4` * Server (where the certificate is loaded): n/a * Client (e.g. browser, CLI tool, or script): n/a ## What you did `mkcert -client -csr ./vsh-csr.pem -cert-file ./vsh.pem` ## What went wrong  ``` ERROR: can only combine -csr with -install and -cert-file ``` ## Additional info - `main()` [checks that `-client` and `-csr` are not passed together](https://github.com/FiloSottile/mkcert/blob/1c1dc4ed27ed5936046b6398d39cab4d657a2d8e/main.go#L139-141) - `makeCertFromCSR()` [checks `client` flag](https://github.com/FiloSottile/mkcert/blob/1c1dc4ed27ed5936046b6398d39cab4d657a2d8e/cert.go#L247), which is always false because of the check above - **Suggestion**: relax check in `main()` to allow passing `-client` to `mkcert -csr` invocations and enable this code path