Frequently asked questions
Short answers, with links to the pages that cover each topic in full.
Can I use homepki for production certificates?
No. Private keys are written unencrypted, there is no online CA, no ACME and no OCSP, and revocation is published only as CRL files. homepki is for local development, demos and tests. Use ACME/Let's Encrypt or your organisation's PKI for anything public-facing.
Does homepki need OpenSSL?
No. homepki is a single Go binary. Key generation, signing and chain verification use Go's crypto/x509, so nothing else has to be installed. OpenSSL is still useful to inspect results by hand.
Which platforms are supported?
macOS and Linux, on amd64 and arm64. There is no Windows binary.
Is it safe to re-run a generate command?
Yes. A generate command refuses to overwrite existing material: it exits non-zero, prints what is in the way, and changes nothing. Pass --force to replace it. On a CA tier that is still destructive, because every certificate below it stops verifying. See Overwrite protection.
How do I re-issue a leaf under the same name?
Pass --force. It writes a new key and certificate over the old pair. The key is regenerated, so anything serving the old pair has to be reloaded.
How is homepki different from mkcert?
Both install their root into the system trust store, Firefox/NSS and Java; homepki does it on macOS and Linux, mkcert on Windows too. homepki adds intermediates, separate client certificates for mTLS, name constraints enforced when it issues, revocation with CRLs, and signing of CSRs generated elsewhere. mkcert issues leaves straight from its root. See vs. other tools.
Where are the files, and how do I start over?
Everything lives under one directory: --workdir, then $, then HOMEPKI_WORKDIR~/.homepki. There is no delete command, so removing a PKI means rm -rf on that directory. Point HOMEPKI_WORKDIR at a temporary directory for a throwaway PKI. See Where the files go.
Does any command prompt for input?
No command asks for a passphrase or a subject. The only prompt is sudo's password, when trust install or trust uninstall changes the system trust store or a Java cacerts file the current user cannot write.
Why does my browser still warn after trust install?
Check three things: the server presents the intermediate after its leaf (the chain file), the name in the URL is one of the certificate's SANs, and the browser was restarted after the root was added. Firefox uses its own NSS store; homepki covers it when certutil is installed. See Trusting the root CA.
Can I use Ed25519 certificates in a browser?
No. Chrome, Safari and Firefox reject Ed25519 certificates. Use RSA or ECDSA for anything a browser opens, and Ed25519 for service-to-service TLS between Go or OpenSSL 1.1.1+ peers. See Key types.
Can I issue an already-expired certificate for a negative test?
No. NotBefore is always 5 minutes in the past, and --validity must be positive. The shortest option is a very short --validity such as 1m, then wait for it to expire.
Can I choose the subject of a certificate?
Not with server-cert or client-cert: the subject is derived from the domain, intermediate and leaf name. To use another common name, generate a CSR with that subject (keeping the O and OU the intermediate requires) and sign it with homepki sign. See Signing external CSRs.