Use local HTTPS

Develop against HTTPS, not HTTP. Secure cookies, service workers, and mixed-content rules all behave differently over TLS. You want to find that out on your laptop, not in production.

Caddy makes this painless. For localhost and other internal names it doesn’t contact a public CA. It creates its own local certificate authority and issues certificates from it. I built Local Hoster, a small CLI that gives every project a .localhost address with HTTPS, on top of exactly this feature.

localhost {
  respond "local HTTPS works"
}

Run it:

caddy run --config Caddyfile

On the first run, Caddy generates the local CA and issues a certificate for localhost. It also tries to install the CA root into your system trust store. That step may ask for your password, because changing what your system trusts is a privileged operation.

Test it

Call the site over HTTPS:

curl https://localhost/

If you get local HTTPS works back, the trust installation worked.

If curl complains about an untrusted certificate, install the root by hand:

caddy trust

caddy trust asks the running Caddy for its root certificate and installs it into your local trust stores. Retry the curl.

Now let’s look at who signed the certificate you’re trusting:

curl -v https://localhost/ 2>&1 | grep issuer

The issuer is the Caddy Local Authority. You’re not talking to Let’s Encrypt. You’re trusting a CA that lives in Caddy’s data directory on this machine, and nowhere else.

Trust is per client

This is the part that trips people up. Trust lives in each client, on each machine.

Your browser works. But a Docker container calling your host fails. Your phone on the same Wi-Fi fails. A colleague’s laptop fails. Each of them has its own trust store, and none of them has ever heard of your Caddy root.

The server cannot push trust to clients. That’s the entire point of a trust store: only the owner of the device decides what to trust. To fix it, export the root from Caddy’s data directory, under pki/authorities/local, and install it on each device you administer.

Keep it local

Never use the local CA for a public site. Nobody outside your machines trusts it, so visitors would see a scary warning.

And never install its root on machines you don’t control. A root certificate is a promise: “trust everything this authority signs”. Make that promise only for devices that are yours.

Try this on your own: find the root.crt file under pki/authorities/local in Caddy’s data directory, then run openssl x509 -in root.crt -noout -subject -dates on it. That’s the certificate every other device needs before it can trust your local sites.