LocalRun

HTTPS & certs

Local HTTPS usually means a self-signed certificate and a browser warning you learn to click through. LocalRun does the other thing: Caddy runs a small certificate authority on your machine, that CA is trusted in your keychain, and the certificates it issues are ordinary valid certificates as far as the browser is concerned.

No interstitial, no exception to add, and fetch from another local app works without disabling verification.

Turning it on

TLS is per project, set when you add it or in the editor:

  • HTTPS: Caddy issues a certificate for <name>.test and serves it on :443.
  • HTTP: plain :80, no certificate.

HTTP is the right choice when something in your stack cannot cope with a private CA: a language runtime with its own trust store, or a tool that pins certificates.

Trusting the CA

The first time a project needs a certificate, LocalRun installs Caddy's root into your login keychain and marks it trusted for SSL.

Login keychain, not System

Trusting a root in the System keychain triggers an authorisation dialog that a background process cannot draw; it fails with "no user interaction was possible" and there is nothing on screen to approve. The login keychain needs no such prompt, and browsers on your account trust it just the same.

Settings shows whether the CA is trusted. That check verifies trust rather than presence, because the two are not the same; a certificate can be sitting in your keychain and still be untrusted, which produces exactly the browser error you were trying to avoid. To confirm by hand:

bash
security verify-cert -p ssl -c ~/Library/Application\ Support/Caddy/pki/authorities/local/root.crt

When the browser still complains

Work down this list:

  1. Check Settings. If the CA row does not say trusted, re-run setup. That reinstalls the root and re-verifies it.
  2. Restart the browser. Chrome and Safari read the trust store at launch; a root trusted after the browser started is not picked up until it restarts.
  3. Check the project is actually on HTTPS. A project set to HTTP has no certificate at all, and https:// will simply fail to connect.
  4. Firefox keeps its own trust store. It does not use the system keychain. Either add the root in Firefox's settings, or enable security.enterprise_roots.enabled in about:config.

A certificate that never arrives

Adding a site means Caddy has to regenerate its configuration, reload, and mint a certificate for the new host. Navigating during that window lands on ERR_SSL_PROTOCOL_ERROR, and browsers cache that failure, so a retry a second later still fails.

Give it a moment and reload. If it persists, check the Caddy row in Settings for the actual error rather than guessing from the browser.

Sharing with another machine

Do not. The root is trusted only on this Mac, and copying a private CA between machines is a bad habit that ends badly. If you need a colleague to reach your dev server, use a tunnel rather than your local certificates.

Next: Always-on covers keeping projects up without opening the app.