Trusted HTTPS for local sites

Short Leash serves every .test site over HTTPS with certificates your browser trusts, from a certificate authority that Short Leash creates on your computer and that can only sign .test names.

Where do the certificates come from?

The first time Short Leash runs, it creates its own certificate authority in its folder. Setup asks macOS to trust it in your login keychain, or Windows in your user's certificate store. Short Leash then issues a certificate for each site the first time it's visited.

Is it safe to trust Short Leash's certificate authority?

It's limited by a name constraint to .test. A certificate it signed for any other domain would be rejected, so it can't be used to impersonate real websites. Its private key never leaves your computer.

Do certificates expire?

Site certificates last at most 397 days, the most browsers accept, and Short Leash renews them automatically.

Why does my script or tool reject the certificate?

Tools that don't read the system's trusted certificates, such as many Node and Python scripts, need Short Leash's certificate authority. Short Leash's own processes get it already. For yours:

leash ca > ~/leash-ca.pem
export NODE_EXTRA_CA_CERTS=~/leash-ca.pem

Can I serve a site over plain HTTP?

Yes: leash unsecure <site>, or turn off HTTPS on the site's Site settings.