Every subdomain of backloop.dev resolves to your own machine, and the
wildcard certificate below is signed by a public authority your browser already trusts.
HTTPS on localhost, with no self-signed certificate and no root CA to install.
Certificates are replaced before they expire. Tools should read
pack.json and refresh when info.notAfter gets close.
| pack.json | Everything in one JSON file. Preferred for anything automated. |
| backloop.dev-cert.crt | The certificate. |
| backloop.dev-ca.crt | The authority chain above it. |
| backloop.dev-bundle.crt | Certificate and chain together. |
| backloop.dev-key.part1.pem | Private key, first half. |
| backloop.dev-key.part2.pem | Private key, second half. |
The key arrives in two pieces that you join back together —
cat backloop.dev-key.part1.pem backloop.dev-key.part2.pem > key.pem. Scanners hunt
for whole private keys in public places and get them revoked, and this certificate is meant to be
public: it only ever secures traffic that stays on your machine.
The npm package downloads and refreshes these files for you.
# Node npm install backloop.dev # Vite npm install --save-dev vite-plugin-backloop.dev
const backloop = require('backloop.dev');
const https = require('https');
const options = await backloop.httpsOptionsPromise();
https.createServer(options, app).listen(443);
// then open https://my-app.backloop.dev/
Or serve a directory over HTTPS straight away with
npx backloop.dev ./public.
A browser will not let a page served over HTTP talk to an HTTPS API, and it will not let an HTTPS page pull anything over HTTP. On localhost that leaves you choosing between a self-signed certificate that every browser and every teammate has to be told to trust, or disabling security warnings during development and hoping nothing follows you to production.
A real certificate for a real domain that happens to point at 127.0.0.1 sidesteps both.