Where Does mkcert Store Its Local CA?
Where mkcert keeps its local CA files, how CAROOT prints and overrides it, and per-OS trust store notes..
Last updated
mkcert keeps one local certificate authority as two files, a certificate and a key, in a platform data folder. The CAROOT command prints it; the CAROOT variable overrides it. Installing registers the CA with system and browser stores per OS.
Generated site certificates go wherever you ask at creation time, separate from the CA home. Guard the key file like a password: anyone holding it mints trusted certs for your machine. WSL setups break when the Windows-side path goes unreachable, a classic cryptic failure.
Where mkcert stores this, by platform
~/.local/share/mkcert
Holds rootCA.pem and rootCA-key.pem for the local authority. Print with mkcert -CAROOT, override with $CAROOT. Node needs NODE_EXTRA_CA_CERTS pointed here. Copy the pem alone to trust other machines.
~/Library/Application Support/mkcert
Same CA pair under the macOS data home. Install registers with system keychain plus browser stores. Keep the key private; the pem alone suffices for trusting teammates' machines.
%LOCALAPPDATA%\mkcert
LocalAppData home for the CA pair on Windows. WSL2 setups referencing this path break when interop fails; check accessibility first. Java clients need manual trust imports regardless of OS.
Frequently asked questions
how do I move my mkcert CA
Run mkcert -CAROOT to print the folder holding rootCA.pem and rootCA-key.pem. Copy rootCA.pem to the new machine, point CAROOT there, and run mkcert -install. Never share the private key beyond your own machines.
how do I run multiple local CAs
Set CAROOT to the desired folder before any mkcert command to keep separate authorities. Each root needs its own install step into trust stores. Name folders clearly; mixing CAs causes baffling trust errors.
Node or Java ignores my certs
Point NODE_EXTRA_CA_CERTS at the rootCA.pem path, since Node skips the system store. Java apps and old clients need manual imports the same way. Browsers generally follow the system store automatically.
Notice an outdated path? Let us know.