[GH-ISSUE #155] Clarify that mkcert and be used as an infrastructure CA #95

New issue

Open

opened 2026-02-25 22:32:35 +03:00 by kerem · 2 comments

kerem commented

2026-02-25 22:32:35 +03:00

Owner

Originally created by @sedalu on GitHub (Apr 13, 2019).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/155

Filippo, as we discussed as GothamGo, using mkcert as an infrastructure CA to secure internal service-to-service http calls is probably a use case falls within the mission of mkcert. The readme provides enough detail on how to do this manually, but it warns against "production" use. Please clarify that this use case is not discouraged. Thanks.

Originally created by @sedalu on GitHub (Apr 13, 2019). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/155 Filippo, as we discussed as GothamGo, using `mkcert` as an infrastructure CA to secure internal service-to-service http calls is probably a use case falls within the mission of `mkcert`. The readme provides enough detail on how to do this manually, but it warns against "production" use. Please clarify that this use case is not discouraged. Thanks.

kerem added the

enhancement

label

2026-02-25 22:32:35 +03:00

kerem commented

2026-02-25 22:32:35 +03:00

Author

Owner

@sawfi commented on GitHub (Jul 6, 2020):

Hii

@sawfi commented on GitHub (Jul 6, 2020): Hii

kerem commented

2026-02-25 22:32:35 +03:00

Author

Owner

@polarathene commented on GitHub (Aug 16, 2020):

For anyone else landing here, you might later find this issue which points you in the direction of step as a production grade alternative to mkcert.

A similar issue discussion also has this to say:

If you're just looking for a simple tool to create certs that work for local development, use mkcert.

If you're testing an ACME integration, use pebble (and step-ca, as a second data point :).

If you need something more sophisticated, like an ACME CA that you can bring into staging or run in production for server-to-server mTLS, check out step & step-ca!

@polarathene commented on GitHub (Aug 16, 2020): For anyone else landing here, you might later find [this issue](https://github.com/FiloSottile/mkcert/issues/154#issuecomment-554782736) which points you in the direction of `step` as a production grade alternative to `mkcert`. A [similar issue discussion](https://github.com/letsencrypt/pebble/issues/298#issuecomment-582532341) also has this to say: > - If you're _just_ looking for a simple tool to create certs that work for local development, use `mkcert`. > - If you're testing an ACME integration, use `pebble` (_and_ `step-ca`, as a second data point :). > - If you need something more sophisticated, like an ACME CA that you can bring into staging or run in production for server-to-server mTLS, check out `step` & `step-ca`!