backloop.dev no longer issues a certificate. It ran for about two years and was ended on 4 September 2026 — not because it stopped being useful, but because the thing it did cannot be done. It is now used privately by its author.
If you arrived here from an article or a package that told you to download certificates from this page, what happened is worth two minutes, and what to use instead follows it.
A browser will not let a page served over HTTP talk to an HTTPS API, and it will not let an HTTPS page pull anything over HTTP. On localhost that leaves you choosing between a self-signed certificate that every browser and every teammate has to be told to trust, or switching off security warnings while developing and hoping the habit does not follow you to production.
backloop.dev sidestepped both. Every subdomain of the domain resolved to
127.0.0.1, and the site handed out a real wildcard certificate for
*.backloop.dev, signed by an authority every browser already trusted.
You got HTTPS on localhost with nothing installed into any trust store.
The DNS still resolves — that part costs nothing and breaks nothing. It is the certificate that is gone.
The last certificate pack is still sitting at its old address, so an existing install fails slowly rather than on a sudden 404. Do not build anything on it: that certificate was revoked on 31 July 2026, it expires on 29 October 2026, and nothing will replace it. A client that checks revocation already rejects it. The individual certificate files it used to sit beside are gone and return 404.
Handing out the certificate meant handing out its private key. That is not a slip in the design, it is the design: a certificate is useless to you without the key that goes with it.
But a publicly trusted certificate whose private key is published is, by definition, a compromised one. CA/Browser Forum Baseline Requirements §4.9.1.1 obliges a certificate authority to revoke within 24 hours of obtaining evidence that a private key is compromised, and a key sitting on a public web page is exactly that evidence. Automated scanners crawl Certificate Transparency logs and public sites looking for precisely this, and they report what they find.
So every certificate this project published was on a countdown from the moment it went up. For a long time the countdown was slow enough to live with: issue, get revoked, issue again, roughly 350 times. Then it stopped being liveable.
| When | What happened |
|---|---|
| 31 Jul 2026 | A certificate is issued at 10:20 and revoked at 19:01 for
keyCompromise — about nine hours. |
| 1 Aug 2026 | That authority blocklists the domain outright. No further issuance, and no practical appeal. |
| 6 Aug 2026 | A commercial wildcard is bought from a different authority to replace it. |
| 8 Aug 2026 | Revoked, same reason — about two days. |
| 4 Sep 2026 | The service is discontinued. |
The keyCompromise revocation reason is not a
judgement call and is not a bug in anyone's process. The rule is working exactly
as written, and it is the rule that makes every other certificate on the web mean
something.
For a while the key was published split across two files, to be joined back together. That bought time against naive scanners and nothing else — the last two certificates were revoked with the split in place.
Nor does changing authority help. The two involved here shared nothing but the Baseline Requirements, and the Baseline Requirements are the problem. Any CA that learns of a published key must revoke, and every CA eventually learns.
The general form, which is the part worth carrying away: a shared, publicly trusted certificate for localhost is not something that can be built. Anyone setting out to build one arrives here, and it is better to know that on the first day than after five weeks.
The working approach is a certificate authority of your own, trusted only on your machine, signing whatever hostnames you want.
Be straight about the trade-off, because it is the exact one backloop.dev existed to avoid: all three install a root certificate into your trust store. That root can sign for any hostname, so its key is worth protecting, and every machine that needs to trust your dev server — a teammate's laptop, a CI runner, a phone on your network — needs its own setup.
That is a real cost. It is also the only version of this that a public certificate authority is not obliged to break.
One piece of this is still standing, and it is free: every subdomain of
backloop.dev still resolves to
127.0.0.1 and ::1. A local
authority will sign whatever name you ask it to, so
mkcert -install
mkcert '*.backloop.dev' backloop.devgives you a locally trusted wildcard for a domain that already points at your
own machine — as many clean HTTPS hostnames as you like, no
/etc/hosts editing, and no public certificate anywhere in
it. That is the closest thing to what this site used to hand out, and nothing about
it can be revoked.