Using a self-signed SSL cert on MacOS

Creating a cert

1. Construct a requirement config and save the file as "req.conf".

   [req]
   distinguished_name = req_distinguished_name
   x509_extensions = v3_req
   prompt = no
   [req_distinguished_name]
   C = MY
   ST = Kuala Lumpur
   L = Kuala Lumpur
   O = Company Name
   CN = localhost
   [v3_req]
   keyUsage = digitalSignature, keyEncipherment, dataEncipherment
   extendedKeyUsage = serverAuth
   subjectAltName = @alt_names
   [alt_names]
   DNS.1 = localhost.abc
   DNS.2 = localhost
   

2. It is important to include "digitalSignature" in the keyUsage field, otherwise modern browsers would block the cert.

3. Run the following OpenSSL command to generate the certificate. Replace the "days" value as needed.

   openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out certificate.pem -config req.conf -extensions 'v3_req'
   

4. Run the following OpenSSL command to get the P12 format.

   openssl pkcs12 -inkey key.pem -in certificate.pem -export -out certificate.p12
   

   If this certificate is also used on older system (E.g. Windows 7), please include the -legacy option.

   openssl pkcs12 -legacy -inkey key.pem -in certificate.pem -export -out certificate.p12
   

5. Or if you need a JKS format.

   keytool -importkeystore -srckeystore certificate.p12 -srcstoretype pkcs12 -destkeystore certificate.jks -deststoretype jks
   

Install Cert on MacOS

1. Go to the "Keychain Access" App on your device.

2. Select "Files", then "Import Items".

3. Select the cert file that you created earlier.

4. Double clicks on the imported cert and expand the trust section

   

5. Set it to "Always Trust".

6. Now you can try to access the HTTPS URL from your browser, and it should be trusted.