# Global developer CAs considered harmful

DevFeed: [Global developer CAs considered harmful](<https://devfeed.tech/articles/global-developer-cas-considered-harmful-19051.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/debugging-https-without-global-root-ca-certs/>)

Author: HTTP Toolkit; Tim Perry

Published: 2020-01-14T13:00:00Z

Content type: opinion

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [Development](<https://devfeed.tech/topics/development.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Python](<https://devfeed.tech/topics/python.md>), [ASP.NET](<https://devfeed.tech/topics/aspnet.md>), [gatsby](<https://devfeed.tech/topics/gatsby.md>), [React](<https://devfeed.tech/topics/react.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Firefox](<https://devfeed.tech/topics/firefox.md>), [container](<https://devfeed.tech/topics/container.md>)

Tags: [certificates](<https://devfeed.tech/tags/certificates.md>), [cli](<https://devfeed.tech/tags/cli.md>), [container](<https://devfeed.tech/tags/container.md>), [dev](<https://devfeed.tech/tags/dev.md>), [developer](<https://devfeed.tech/tags/developer.md>), [development](<https://devfeed.tech/tags/development.md>), [firefox](<https://devfeed.tech/tags/firefox.md>), [http](<https://devfeed.tech/tags/http.md>), [internet-traffic](<https://devfeed.tech/tags/internet-traffic.md>), [npm](<https://devfeed.tech/tags/npm.md>), [os](<https://devfeed.tech/tags/os.md>), [password](<https://devfeed.tech/tags/password.md>), [react](<https://devfeed.tech/tags/react.md>), [security](<https://devfeed.tech/tags/security.md>), [tls](<https://devfeed.tech/tags/tls.md>)

## AI overview

The article warns that developer tools which install locally generated certificate authorities into global system or browser trust stores can expose HTTPS traffic to anyone who obtains the CA key. It argues that local HTTPS development and HTTPS debugging tools should work without globally trusted CAs, and names several tools that use this pattern.

## Source excerpt

Certificate infrastructure is built on trust. If you trust the wrong thing, it all falls down. Unfortunately, we developers do it all the time anyway. YOLO. A remarkable number of dev tools & practices encourage or require you to globally trust a certificate authority (CA) that they provide or generate locally. If you do so these, anybody with access to the key for that CA can rewrite any HTTPS traffic between you and anything, and take almost complete control of your internet traffic. We don't need to do this. These tools could easily work without globally installed CAs, and they open you to unnecessary risks by not doing so. We can do better. Who does this? Lots of different dev tools, for a couple of different reasons. First, there's a selection of tools that generate HTTPS CAs & certificate for local development servers, and trust them for you globally & automatically. That lets you easily run a local HTTPS server on a hostname where certs aren't otherwise available, like localhost or other local hostnames (my-docker-container:8080). That's often useful because more and more web features are limited to only HTTPS origins. The tools doing this include: mkcert - a go-based CLI tool that generates a CA and then automatically trusts it everywhere, recommended for HTTPS setup with everything from ASP.NET to Python. $ mkcert -install Created a new local CA at "/Users/filippo/Library/Application Support/mkcert" 💥 The local CA is now installed in the system trust store! ⚡ The local CA is now installed in the Firefox trust store (requires browser restart)! 🦊 Devcert - an npm module which creates a self-signed CA, and automatically trusts this CA globally in the OS keystore and in all browsers it finds. Gatsby - a static site framework. Running Gatsby with --https will generate a CA, prompt you for your password, and then trust it automatically & globally, in both your system cert store and every browser store it can find. Create-React-App - the official toolchain for se