starred/mkcert

Fork 0

mirror of https://github.com/FiloSottile/mkcert.git synced 2026-04-25 13:36:02 +03:00

[GH-ISSUE #76] [Question] How to generate a fullchain cert file? #42

New issue

Closed

opened 2026-02-25 22:32:27 +03:00 by kerem · 8 comments

kerem commented

2026-02-25 22:32:27 +03:00

Owner

Originally created by @saicrazyfire on GitHub (Oct 1, 2018).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/76

I'm looking to leverage this on internally hosted Home Assistant and they have a Nginx proxy. I want to be able to access the web application via something like "https://hassio.local". I can create the cert and the key with mkcert but the Nginx addon for HA needs the fullchain.

Originally created by @saicrazyfire on GitHub (Oct 1, 2018). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/76 I'm looking to leverage this on internally hosted Home Assistant and they have a Nginx proxy. I want to be able to access the web application via something like "https://hassio.local". I can create the cert and the key with mkcert but the Nginx addon for HA needs the fullchain.

kerem

2026-02-25 22:32:27 +03:00

closed this issue
added the
question
label

kerem commented

2026-02-25 22:32:27 +03:00

Author

Owner

@adamdecaf commented on GitHub (Oct 2, 2018):

There's only the root CA and your leaf certs. When you mkcert -install it tells you where the CA certificate is.

$ mkcert -install
Created a new local CA at "/home/adam/.local/share/mkcert" 💥
The local CA is now installed in the system trust store! ⚡️
Warning: "certutil" is not available, so the CA can't be automatically installed in Firefox and/or Chrome/Chromium! ⚠️
Install "certutil" with "apt install libnss3-tools" or "yum install nss-tools" and re-run "mkcert -install" 👈

$ ls -l ~/.local/share/mkcert/
total 8
-r-------- 1 adam adam 2484 Oct  2 08:49 rootCA-key.pem
-rw-r--r-- 1 adam adam 1655 Oct  2 08:49 rootCA.pem

mkcert hassio.local would then generate the leaf cert and key in the directory you call mkcert from.

@adamdecaf commented on GitHub (Oct 2, 2018): There's only the root CA and your leaf certs. When you `mkcert -install` it tells you where the CA certificate is. ``` $ mkcert -install Created a new local CA at "/home/adam/.local/share/mkcert" 💥 The local CA is now installed in the system trust store! ⚡️ Warning: "certutil" is not available, so the CA can't be automatically installed in Firefox and/or Chrome/Chromium! ⚠️ Install "certutil" with "apt install libnss3-tools" or "yum install nss-tools" and re-run "mkcert -install" 👈 $ ls -l ~/.local/share/mkcert/ total 8 -r-------- 1 adam adam 2484 Oct 2 08:49 rootCA-key.pem -rw-r--r-- 1 adam adam 1655 Oct 2 08:49 rootCA.pem ``` `mkcert hassio.local` would then generate the leaf cert and key in the directory you call `mkcert` from.

kerem commented

2026-02-25 22:32:27 +03:00

Author

Owner

@saicrazyfire commented on GitHub (Oct 2, 2018):

So would it be enough to concatenate rootCA.pem and hassio.pem and have a fullchain.pem? At least from what I could google, the full chain cert is that

@saicrazyfire commented on GitHub (Oct 2, 2018): So would it be enough to concatenate rootCA.pem and hassio.pem and have a fullchain.pem? At least from what I could google, the full chain cert is that

kerem commented

2026-02-25 22:32:27 +03:00

Author

Owner

@adamdecaf commented on GitHub (Oct 2, 2018):

Yea, looks like the nginx docs mention that.

https://nginx.org/en/docs/http/configuring_https_servers.html#chains

@adamdecaf commented on GitHub (Oct 2, 2018): Yea, looks like the nginx docs mention that. https://nginx.org/en/docs/http/configuring_https_servers.html#chains

kerem commented

2026-02-25 22:32:27 +03:00

Author

Owner

@FiloSottile commented on GitHub (Jan 6, 2019):

Since mkcert does not generate intermediate CAs, you should be able to use the certificate alone as "fullchain". If not, you just need to concatenate the file in $(mkcert -CAROOT)/rootCA.pem, but browsers don't need the root to be sent to them.

@FiloSottile commented on GitHub (Jan 6, 2019): Since mkcert does not generate intermediate CAs, you should be able to use the certificate alone as "fullchain". If not, you just need to concatenate the file in `$(mkcert -CAROOT)/rootCA.pem`, but browsers don't need the root to be sent to them.

kerem commented

2026-02-25 22:32:27 +03:00

Author

Owner

@BarnabasSzabolcs commented on GitHub (Oct 24, 2019):

Unfortunately it looks like python's requests needs it.

@BarnabasSzabolcs commented on GitHub (Oct 24, 2019): Unfortunately it looks like python's requests needs it.

kerem commented

2026-02-25 22:32:27 +03:00

Author

Owner

@FiloSottile commented on GitHub (Oct 24, 2019):

Should be as simple as

mkcert example.com
cat example.com.pem > example.com-fullchain.pem
cat "$(mkcert -CAROOT)/rootCA.pem" >> example.com-fullchain.pem

@FiloSottile commented on GitHub (Oct 24, 2019): Should be as simple as ``` mkcert example.com cat example.com.pem > example.com-fullchain.pem cat "$(mkcert -CAROOT)/rootCA.pem" >> example.com-fullchain.pem ```

kerem commented

2026-02-25 22:32:27 +03:00

Author

Owner

@BarnabasSzabolcs commented on GitHub (Oct 25, 2019):

Thanks a bunch, Filo!

@BarnabasSzabolcs commented on GitHub (Oct 25, 2019): Thanks a bunch, Filo!

kerem commented

2026-02-25 22:32:27 +03:00

Author

Owner

@emahuni commented on GitHub (Nov 8, 2019):

Should be as simple as

mkcert example.com
cat example.com.pem > example.com-fullchain.pem
cat "$(mkcert -CAROOT)/rootCA.pem" >> example.com-fullchain.pem

That's not the fullchain, that's just the chain. Fullchain is the cert.pem at the top + the chain at the bottom.
See #214 for the correct way of generating these files. I do this all the time developing SIP technologies that need SSL. They require these kind of files.

https://community.letsencrypt.org/t/public-and-private-keys/25493/3?u=emahuni

@emahuni commented on GitHub (Nov 8, 2019): > Should be as simple as > > ``` > mkcert example.com > cat example.com.pem > example.com-fullchain.pem > cat "$(mkcert -CAROOT)/rootCA.pem" >> example.com-fullchain.pem > ``` That's not the fullchain, that's just the chain. Fullchain is the cert.pem at the top + the chain at the bottom. See #214 for the correct way of generating these files. I do this all the time developing SIP technologies that need SSL. They require these kind of files. https://community.letsencrypt.org/t/public-and-private-keys/25493/3?u=emahuni

kerem referenced this issue

2026-02-25 22:33:17 +03:00

[PR #46] [MERGED] Add Windows Support #369