Trusting self-signed certificates on a Macbook
Sometimes I need to create self-signed certificates and interact with an application in the browser. The browser and OS don't really like that. But I know its secure, and temporary, so I want to tell my computer to chill out and trust the CA.
Command I use to generate the self-signed cert:
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout mycert.key -out mycert.crt \
-subj "/CN=myhost.local"
Translation: create a new 2048-bit private key, and use it to sign a certificate for the hostname myhost.local, valid for 365 days, with no password on the key. Since it's self-signed, this one cert acts as both the certificate and its own CA.
Command I use to add the cert to the trust store on MacOS:
sudo security add-trusted-cert -d -r trustRoot \
-k /Library/Keychains/System.keychain mycert.crt
Translation: add this certificate to the System keychain, and mark it as a fully trusted root, meaning the OS and every app that reads the System keychain (browsers, Docker, etc.) should treat it as valid without complaint.
Note: for container based applications, a restart of Docker or Orbstack is required because it only reads the keychain's trust store at startup.