selfhost.directory

The index of self-hostable projects — ranked, categorized and served with live updates.
Own your data and stop giving it to big tech.

mkcertWeb logo

Self-host mkcertWeb

v4.4.2

Web UI for generating local TLS certificates with mkcert

ReleaseOpen SourceGPL-3.0
Updated10 hours ago
LanguageJavaScript
Setup difficultyModerate
MobileResponsive
ThemeDark mode
Stars
221
Ports
3000 (HTTP server), 3443 (HTTPS server)
Requires
Mkcert, OpenSSL
Docker
jeffcaldwellca/mkcertweb
Install with Docker
Certificate generation and management interface showing the main dashboard

What is mkcertWeb?

mkcert Web UI is a self-hosted web application that gives developers a graphical interface for the mkcert command-line tool. It lets you create locally-trusted TLS certificates for many domains and IP addresses, exporting them in PEM, CRT, and PFX formats. A built-in SCEP server handles automatic device enrollment on iOS, macOS, and Windows. Security features include protection against command injection and path traversal, plus multi-tier rate limiting. Authentication supports username/password login and OpenID Connect single sign-on with providers such as Azure AD, Google, and Okta. Certificate expiry monitoring sends automated alerts via SMTP email, ntfy push notifications, or generic webhooks. The interface offers dark and light themes with responsive design. Deployment options include Docker Compose (recommended) or local Node.js installation with mkcert and OpenSSL as prerequisites. Licensed under GPL-3.0.

Should you self-host mkcertWeb?

mkcertWeb scores 48/100 on selfhost.directory (how scoring works) and ranks #6 of 8 in Certificate Management. It has 221 GitHub stars.

It shipped 13 stable releases in the past year. The latest, v4.4.2, came out on 15 October 2026. New versions land roughly every 10 days.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is GPL-3.0-licensed and written mostly in JavaScript.

Its closest alternative on selfhost.directory is Certimate (67/100, 9 410 stars). It scores higher overall, so compare the two before you pick. See mkcertWeb vs Certimate side by side.

Features

  • Basic Authentication
  • Certificate Expiry Monitoring
  • Certificate Generation
  • Certificate Notes
  • Command Injection Protection
  • Email notifications
  • Multiple certificate formats
  • Ntfy push notifications
  • OpenID Connect SSO
  • Rate Limiting
  • REST API
  • SCEP Enrollment
  • Webhook Notifications

mkcertWeb README

How to install mkcertWeb

Install mkcertWeb with Docker

Docker

docker build -t mkcert-web-ui . docker run -d
--name mkcert-web-ui
-p 3000:3000
-v mkcert_certificates:/app/certificates
-v mkcert_data:/app/data
-v mkcert_config:/app/config
-v mkcert_ca:/home/nodejs/.local/share/mkcert
mkcert-web-ui

Manual Docker run with named volumes for persistence.

How to configure mkcertWeb

  • API_RATE_LIMIT_MAX100
  • API_RATE_LIMIT_WINDOW900000
  • AUTH_PASSWORD
  • AUTH_USERNAMEadmin
  • CERT_CHECK_INTERVAL0 8 * * *
  • CERT_CRITICAL_DAYS7
  • CERT_DIR
  • CERT_MONITORING_ENABLEDfalseCertificate Monitoring Configuration

    Certificate Monitoring Configuration

  • CERT_MONITOR_UPLOADEDtrue
  • CERT_WARNING_DAYS30
  • CLI_RATE_LIMIT_MAX10
  • CLI_RATE_LIMIT_WINDOW900000Rate Limiting Configuration

    Rate Limiting Configuration

  • DEFAULT_THEMEdark
  • EMAIL_FROMmkcert-web-ui@localhost
  • EMAIL_NOTIFICATIONS_ENABLEDfalseEmail Notification Configuration

    Email Notification Configuration

  • EMAIL_SUBJECTCertificate Expiry Alert - mkcert Web UI
  • EMAIL_TO
  • ENABLE_AUTHfalseAuthentication Configuration

    Authentication Configuration

  • ENABLE_HTTPStrueSSL/HTTPS Configuration

    SSL/HTTPS Configuration

  • ENABLE_OIDCfalseOpenID Connect (OIDC) SSO Authentication Configuration

    OpenID Connect (OIDC) SSO Authentication Configuration

  • FORCE_HTTPSfalse
  • HTTPS_PORT3443
  • NODE_ENVdevelopmentApplication Configuration

    Application Configuration

  • NTFY_ENABLEDfalseEnable ntfy push notifications

    Enable ntfy push notifications

  • NTFY_TOKENntfy access token (or `NTFY_USERNAME`/`NTFY_PASSWORD`)

    ntfy access token (or `NTFY_USERNAME`/`NTFY_PASSWORD`)

  • NTFY_TOPICntfy topic

    ntfy topic

  • NTFY_URLhttps://ntfy.shntfy server URL

    ntfy server URL

  • OIDC_CALLBACK_URLhttp://localhost:3000/auth/oidc/callback
  • OIDC_CLIENT_ID
  • OIDC_CLIENT_SECRET
  • OIDC_ISSUER
  • OIDC_SCOPEopenid profile email
  • PORT3000Server Configuration

    Server Configuration

  • SESSION_SECRET
  • SMTP_HOST
  • SMTP_PASSWORD
  • SMTP_PORT587
  • SMTP_SECUREfalse
  • SMTP_TLS_REJECT_UNAUTHORIZEDtrue
  • SMTP_USER
  • SSL_DOMAINlocalhost
  • THEME_MODEdarkUI theme (dark/light)

    UI theme (dark/light)

  • WEBHOOK_ENABLEDfalseEnable generic HTTP webhook notifications

    Enable generic HTTP webhook notifications

  • WEBHOOK_URLWebhook target URL (custom headers: Settings UI only)

    Webhook target URL (custom headers: Settings UI only)

mkcertWeb releases & version history

More in Certificate Management

Rate this project

Click to rate — no account needed.

0 comments

Posting as guest
Loading comments…