# filosottile/mkcert architecture

> Architecture diagram of the GitHub repository filosottile/mkcert, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/filosottile/mkcert
- Repository: https://github.com/filosottile/mkcert

## Overview

mkcert is a command-line tool for creating locally trusted development certificates. Its main workflow parses names and options, loads or creates a local CA, issues a certificate (or signs a supplied CSR), and writes certificate/key or PKCS#12 output. A separate install/uninstall workflow manages the CA in system, NSS browser, and Java trust stores. The excerpts show the command and certificate logic plus platform adapters; links to adapters represent platform-selected implementations, and unsampled workflow details are omitted.

Main entry points: [`main.go`](https://github.com/filosottile/mkcert/blob/master/main.go) (Install / uninstall), [`cert.go`](https://github.com/filosottile/mkcert/blob/master/cert.go) (Certificate issuance), [`truststore_windows.go`](https://github.com/filosottile/mkcert/blob/master/truststore_windows.go) (System trust adapter), [`truststore_linux.go`](https://github.com/filosottile/mkcert/blob/master/truststore_linux.go) (Linux trust adapter)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cli["CLI workflows"]
  node_command["CLI command<br/>[main.go]"]
  node_namecheck["Name validation<br/>[main.go]"]
  node_trustflow["Install / uninstall<br/>[main.go]"]
end

subgraph group_ca["CA and issuance"]
  node_caroot[("CA files<br/>[cert.go]")]
  node_caops["Load / create CA<br/>[cert.go]"]
  node_issue["Certificate issuance<br/>[cert.go]"]
  node_csr["CSR signing<br/>[cert.go]"]
  node_keygen["Key generation<br/>[cert.go]"]
  node_outputs["Certificate outputs<br/>[cert.go]"]
end

subgraph group_trust["Trust-store management"]
end

subgraph group_platform["Platform adapters"]
  node_system["System trust adapter"]
  node_linuxsystem["Linux trust adapter"]
  node_macsystem["macOS trust adapter"]
  node_nss["NSS / Firefox<br/>[truststore_nss.go]"]
  node_java["Java trust adapter<br/>[truststore_java.go]"]
end

node_user(("Developer"))
node_osstore[("OS root store")]
node_browserstore[("Browser certificate stores")]
node_javastore[("Java cacerts")]

node_user -->|"runs"| node_command
node_command -->|"validates names"| node_namecheck
node_command -->|"dispatches mode"| node_trustflow
node_command -->|"loads CA"| node_caops
node_caops -->|"reads / writes"| node_caroot
node_command -->|"issues certificate"| node_issue
node_command -->|"signs CSR"| node_csr
node_issue -->|"generates key"| node_keygen
node_issue -->|"uses CA"| node_caroot
node_csr -->|"uses CA"| node_caroot
node_issue -->|"writes PEM / P12"| node_outputs
node_csr -->|"writes certificate"| node_outputs
node_trustflow -->|"uses CA certificate"| node_caroot
node_trustflow -.->|"dispatches platform"| node_system
node_trustflow -.->|"dispatches platform"| node_linuxsystem
node_trustflow -.->|"dispatches platform"| node_macsystem
node_trustflow -->|"installs / checks"| node_nss
node_trustflow -->|"installs / checks"| node_java
node_system -->|"updates"| node_osstore
node_linuxsystem -->|"updates"| node_osstore
node_macsystem -->|"updates"| node_osstore
node_nss -->|"updates via certutil"| node_browserstore
node_java -->|"updates via keytool"| node_javastore

click node_command "https://github.com/filosottile/mkcert/blob/master/main.go"
click node_namecheck "https://github.com/filosottile/mkcert/blob/master/main.go"
click node_trustflow "https://github.com/filosottile/mkcert/blob/master/main.go"
click node_caroot "https://github.com/filosottile/mkcert/blob/master/cert.go"
click node_caops "https://github.com/filosottile/mkcert/blob/master/cert.go"
click node_issue "https://github.com/filosottile/mkcert/blob/master/cert.go"
click node_csr "https://github.com/filosottile/mkcert/blob/master/cert.go"
click node_keygen "https://github.com/filosottile/mkcert/blob/master/cert.go"
click node_outputs "https://github.com/filosottile/mkcert/blob/master/cert.go"
click node_system "https://github.com/filosottile/mkcert/blob/master/truststore_windows.go"
click node_linuxsystem "https://github.com/filosottile/mkcert/blob/master/truststore_linux.go"
click node_macsystem "https://github.com/filosottile/mkcert/blob/master/truststore_darwin.go"
click node_nss "https://github.com/filosottile/mkcert/blob/master/truststore_nss.go"
click node_java "https://github.com/filosottile/mkcert/blob/master/truststore_java.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_command,node_namecheck,node_trustflow toneBlue
class node_caroot,node_caops,node_issue,node_csr,node_keygen,node_outputs,node_osstore,node_browserstore,node_javastore toneAmber
class node_system,node_linuxsystem,node_macsystem,node_nss,node_java toneRose
class node_user toneIndigo
```

## Components

### CLI workflows

- [CLI command](https://github.com/filosottile/mkcert/blob/master/main.go): `main.go`
- [Name validation](https://github.com/filosottile/mkcert/blob/master/main.go): `main.go`
- [Install / uninstall](https://github.com/filosottile/mkcert/blob/master/main.go): `main.go`

### CA and issuance

- [CA files](https://github.com/filosottile/mkcert/blob/master/cert.go): `cert.go`
- [Load / create CA](https://github.com/filosottile/mkcert/blob/master/cert.go): `cert.go`
- [Certificate issuance](https://github.com/filosottile/mkcert/blob/master/cert.go): `cert.go`
- [CSR signing](https://github.com/filosottile/mkcert/blob/master/cert.go): `cert.go`
- [Key generation](https://github.com/filosottile/mkcert/blob/master/cert.go): `cert.go`
- [Certificate outputs](https://github.com/filosottile/mkcert/blob/master/cert.go): `cert.go`

### Platform adapters

- [System trust adapter](https://github.com/filosottile/mkcert/blob/master/truststore_windows.go): `truststore_windows.go`
- [Linux trust adapter](https://github.com/filosottile/mkcert/blob/master/truststore_linux.go): `truststore_linux.go`
- [macOS trust adapter](https://github.com/filosottile/mkcert/blob/master/truststore_darwin.go): `truststore_darwin.go`
- [NSS / Firefox](https://github.com/filosottile/mkcert/blob/master/truststore_nss.go): `truststore_nss.go`
- [Java trust adapter](https://github.com/filosottile/mkcert/blob/master/truststore_java.go): `truststore_java.go`

### Other components

- **Developer**
- **OS root store**
- **Browser certificate stores**
- **Java cacerts**

## Connections

- Developer → CLI command: runs
- CLI command → Name validation: validates names
- CLI command → Install / uninstall: dispatches mode
- CLI command → Load / create CA: loads CA
- Load / create CA → CA files: reads / writes
- CLI command → Certificate issuance: issues certificate
- CLI command → CSR signing: signs CSR
- Certificate issuance → Key generation: generates key
- Certificate issuance → CA files: uses CA
- CSR signing → CA files: uses CA
- Certificate issuance → Certificate outputs: writes PEM / P12
- CSR signing → Certificate outputs: writes certificate
- Install / uninstall → CA files: uses CA certificate
- Install / uninstall → System trust adapter: dispatches platform
- Install / uninstall → Linux trust adapter: dispatches platform
- Install / uninstall → macOS trust adapter: dispatches platform
- Install / uninstall → NSS / Firefox: installs / checks
- Install / uninstall → Java trust adapter: installs / checks
- System trust adapter → OS root store: updates
- Linux trust adapter → OS root store: updates
- macOS trust adapter → OS root store: updates
- NSS / Firefox → Browser certificate stores: updates via certutil
- Java trust adapter → Java cacerts: updates via keytool