Trusted local certificates with mkcert and Go TLS server

When working on local environment, it is useful to use trusted TLS certificates. For this purpose we can use mkcert.

mkcert automatically creates and installs a local CA in the system root store, and generates locally-trusted certificates.

Working code example can be found on GitHub


First we need to install it

❯ mkcert -install
The local CA is already installed in the system trust store! 👍
The local CA is already installed in the Firefox trust store! 👍

Generating the certificate

Then we can generate the cert for all domains that we would like to use.

❯ mkcert "*" example.test localhost ::1

Created a new certificate valid for the following names 📜
 - ""
 - "*"
 - "example.test"
 - "localhost"
 - ""
 - "::1"

Reminder: X.509 wildcards only go one level deep, so this won't match ℹ️

The certificate is at "./" and the key at "./" ✅

It will expire on 5 July 2026 🗓

Creating TLS server

Now we can use it in our http.ListenAndServeTLS

func main() {
	mux := http.NewServeMux()
	mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
		_, err := io.WriteString(w, "Hello World, TLS!\n")
		if err != nil {
	log.Println("Starting listening on port 8443, open")
	log.Fatal(http.ListenAndServeTLS(":8443", "", "", mux))


First let’s start Go server.

❯ go run main.go
2024/04/05 23:49:04 Starting listening on port 8443, open

When we curl, we can see that the cert is accepted.

 ❯ curl -v
* Server certificate:
*  subject: O=mkcert development certificate; OU=XXX
*  start date: Apr  5 21:24:54 2024 GMT
*  expire date: Jul  5 21:24:54 2026 GMT
*  subjectAltName: host "" matched cert's IP address!
*  issuer: O=mkcert development CA; OU=XXX; CN=mkcert XXX
*  SSL certificate verify ok.
> GET / HTTP/2
> Host:
> User-Agent: curl/8.4.0
> Accept: */*
< HTTP/2 200
< content-type: text/plain; charset=utf-8
< content-length: 18
< date: Fri, 05 Apr 2024 21:33:39 GMT
Hello World, TLS!

The same works in the browser. We don’t need to accept an untrusted cert.

mkcert Go TLS trusted local certificate

Join the Newsletter

Subscribe to get my latest content by email.

    I won't send you spam. Unsubscribe at any time.

    For comments, please send me 📧 an email