Certificates
Joppa's local certificate authority, per-domain certificates, reusing mkcert and getting the system to trust it.
The certificate authority
On first launch, Joppa creates a certificate authority (CA) specific to your user, “Joppa local CA”, valid for 10 years. Its private key stays on your machine, readable only by you, in Joppa’s ca/ folder.
If you already use mkcert, Joppa reuses its CA (the one in $CAROOT, otherwise in mkcert’s default location). Joppa’s certificates are then accepted everywhere mkcert’s already were. Settings › Certificate authority shows which one is in use: “Joppa” or “mkcert (shared)”.
Domain certificates
Joppa signs a certificate on the fly, on the first connection to each domain. It covers the domain and its subdomains (myproject.test and *.myproject.test) and is valid for 397 days, the maximum browsers accept. There’s nothing to generate or renew.
Get the CA trusted
The browser only shows the padlock if the system trusts the CA. Settings › Certificate authority shows the status and the command to run once:
| System | Command | Check |
|---|---|---|
| macOS | sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "<rootCA.pem>" |
Automatic |
| Linux | sudo cp <rootCA.pem> /usr/local/share/ca-certificates/joppa-rootCA.crt && sudo update-ca-certificates |
Joppa can’t check it |
The status bar shows CA joppa ok when it’s trusted, CA joppa not trusted otherwise.