mkcert

> So is it just a wrapper around MitM Proxy? Yes. I created something similar months ago [*] but using Envoy Proxy [1], mkcert [2], my own Go (golang) server, and Little Snitch [3]. It works quite well. I was the first person to notice that Codex CLI now sends telemetry to ab.chatgpt.com and other curiosities like that, but I never bothered to open-source my implementation because I know that anyone genuinely interested could easily replicate it in an afternoon with their favourite Agent CLI. [1] https://www.envoyproxy.io/ [2] https://github.com/FiloSottile/mkcert [3] https://www.obdev.at/products/littlesnitch/ [*] In reality, I created this something like 6 years ago, before LLMs were popular, originally as a way to inspect all outgoing HTTP(s) traffic from all the apps installed in my macOS system. Then, a few months ago, when I started

I haven't used it, but I think `mkcert` is the go to solution for this. [0] [0]: https://github.com/FiloSottile/mkcert

Most people find the user experience of self-signed certificates much worse. The developer experience for local issuance isn't great, although mkcert does a really great job of smoothing the parts that can be smoothed[1]. [1]: https://github.com/FiloSottile/mkcert

There is also mkcert by Filippo Valsorda (no relation to mkcert.org) at https://github.com/FiloSottile/mkcert

Interesting, just checked out if mkcert (the popular way of doing this) supports it and found two issues: https://github.com/FiloSottile/mkcert/issues/131 https://github.com/FiloSottile/mkcert/pull/113 Hopefully Filippo revisits this now that it's broadly supported.

That isn't so tiny. This is tiny. https://github.com/FiloSottile/mkcert

mkcert can help with this! https://github.com/FiloSottile/mkcert As one-time-setup you’ll need to serve the ROOTCA.pem from the Pi and download and install it on the iPad, but once you’ve done this once, any certs you generate on the Pi will be accepted by the iPad. mkcert has enabled so many crazy setups and workflows for me over the years, it’s truly fantastic.

mkcert might be getting this as well: https://github.com/FiloSottile/mkcert/pull/309/commits/92215... (this is linked from the current submission's readme)

Not sure about lesser known but my top tools are: - Caddy server (Auto SSL, Dead simple Reverse Proxy) [0] - mkcert(local SSL) [1] - AWS Global Accelerator [2] (Static IP, Route traffic based on location) [2] [0] https://caddyserver.com/ [1] https://github.com/FiloSottile/mkcert [2] https://aws.amazon.com/global-accelerator/

I use https://github.com/FiloSottile/mkcert for my internal stuff.

Yep, this is what I do using mkcert [0] and it works great. One-time setup of 15m to install certs on your dev devices. [0] https://github.com/FiloSottile/mkcert

If anyone wants their own HSM, Nitrokey and Yubikey sell them: * https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7 * https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/ Consider buying two to have backups ((encrypted) export/import-backup/restore is supported). Creating your own CA: * https://docs.nitrokey.com/hsm/mac/certificate-authority Considering using 'helper software' for running a CA: * https://github.com/smallstep / https://smallstep.com/docs/step-ca/ * https://github.com/OpenVPN/easy-rsa * https://hohnstaedt.de/xca/ * https://github.com/FiloSottile/mkcert (good for on-one-host dev stuff)

You don't even need to mess with a wildcard from Lets Encrypt, just use https://github.com/FiloSottile/mkcert