HTTPS & certificates · Documentation

LaraMonster gives every site a real HTTPS certificate, signed by a certificate authority (CA) that it creates on your computer. Trust that CA once and every https:// site shows a valid padlock: in browsers, in curl, and in PHP's own HTTP calls.

Why HTTPS locally

Some things only work, or only work the same as in production, on a secure page:

Cookies marked Secure and SameSite=None (Sanctum SPAs, embedded apps)
OAuth sign-in and payment callbacks that insist on https:// redirect URLs
Service workers, PWAs, the clipboard, camera and geolocation APIs
Webhooks from Stripe, GitHub and others through a public link
Mixed-content bugs, which you'd otherwise only find after deploying

Trusting the certificate authority

The first-run setup does this, and won't finish without it. To do it again (after a reinstall, or for a new browser profile), use SettingsHTTPS certificatesTrust certificate authority, or:

$ laramonster trust
Adding the LaraMonster root certificate to your trust stores…
✓ trusted — restart your browser

Your system asks for your password once. Settings shows two lines afterwards:

Line	Covers
System	curl, PHP, and Chrome/Edge/Safari on macOS and Windows
Browsers	Firefox everywhere, and Chrome/Chromium on Linux. These keep their own certificate store (NSS) and need the `certutil` tool, which you can install from Tools (Browser certificate tools).

Restart your browser once after trusting so it reads the new CA.

Serving a site over HTTPS

Turn on Serve over HTTPS in the site panel, tick it in the new-project wizard, or run:

$ laramonster secure shop          # https://shop.localhost:8443

Plain http:// requests to a secure site redirect to https://. Remember to update APP_URL in the project's .env (the site panel offers to when you change it there):

APP_URL=https://shop.localhost:8443

Trust it by hand

When the password prompt can't appear (no graphical sudo on Linux, a managed Mac, a locked-down Windows), add the certificate yourself. Its file is data/pki/authorities/local/root.crt inside the LaraMonster home folder; the setup step and Settings show the full path with a copy button.

macOS

# Add it to your login keychain as trusted (asks for your password)
$ security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db \
    "$HOME/Library/Application Support/laramonster/data/pki/authorities/local/root.crt"

Firefox: open about:preferences#privacy → View Certificates → Authorities → Import, choose the same file and tick Trust this CA to identify websites.

Windows

# Your user's trusted roots; Windows asks you to confirm. No administrator needed.
PS> certutil -user -addstore Root "$env:APPDATA\laramonster\data\pki\authorities\local\root.crt"

Firefox on Windows reads the Windows store, so it trusts it too after a restart.

Linux

Pick the line for your distribution, then the browser line:

CA="$HOME/.config/laramonster/data/pki/authorities/local/root.crt"

# Arch, Manjaro, Fedora, openSUSE (p11-kit)
$ sudo trust anchor --store "$CA"

# Debian, Ubuntu, Mint
$ sudo cp "$CA" /usr/local/share/ca-certificates/laramonster.crt && sudo update-ca-certificates

# Chrome and Chromium (needs certutil: libnss3-tools, nss-tools or nss)
$ certutil -d sql:$HOME/.pki/nssdb -A -t C,, -n "LaraMonster Root CA" -i "$CA"

For Firefox, import the file under about:preferences#privacy → View Certificates → Authorities, or run the certutil line with -d sql: pointing at your Firefox profile folder.

Then click Check again in setup, or look at SettingsHTTPS certificates.

Removing the trust

$ laramonster untrust

This removes LaraMonster's CA from the system and browser stores. Run it before deleting LaraMonster's home folder. The CA's private key never leaves your computer, and each install creates its own, so no one else can issue certificates your browser trusts.

Still seeing a warning?

See Troubleshooting → The browser says the connection isn't private.