A shared certificate for *.backloop.dev, so you get HTTPS on
localhost without generating anything yourself. Install it once per machine.
Every hostname under backloop.dev resolves to 127.0.0.1 and
::1. This page publishes a certificate for all of them, together with its
private key, so that anybody can use it.
It is self-signed. No certificate authority issued it, which is the entire point: the previous certificate was revoked because publishing a key obliges a certificate authority to revoke, and there is no authority here to oblige. Nothing can take this one away. The cost is that your machine does not trust it until you say so, which is what the rest of this page is about.
The private key is public. Anyone has it. Once you install this
certificate, someone who can redirect your machine's DNS for a
*.backloop.dev hostname could present a page your browser accepts.
Two things bound that. It is a leaf certificate, not a certificate authority, so it cannot be used to sign any other hostname: your bank and your email are untouched, and that is the difference between this and installing a root. And these hostnames point at your own machine, so an attacker needs to control your DNS before any of it applies.
If that is not a trade you want to make, do not install it. Use your own certificate instead, which the tooling supports directly and which is the better answer whenever you can manage it.
Download backloop.dev-cert.crt, then follow the section for your system.
Double-click the file to add it to Keychain Access, find *.backloop.dev
under the login keychain, open it, expand Trust, and set
Secure Sockets Layer (SSL) to Always Trust. Or do it in one
command:
security add-trusted-cert -r trustRoot -p ssl \
-k ~/Library/Keychains/login.keychain-db backloop.dev-cert.crtSetting the SSL policy rather than blanket trust keeps it to TLS and nothing else. Safari and Chrome pick this up.
To remove it later, run this, and run it first:
security remove-trusted-cert backloop.dev-cert.crtDeleting the certificate from Keychain Access, by dragging it
to the trash or with security delete-certificate, is not
enough. The trust setting is stored separately, keyed by the certificate, and it
survives the certificate being deleted. Your machine goes on trusting this certificate
even though it appears to be gone, and security dump-trust-settings will
report nothing while that is happening. Measured on macOS 26. Remove the trust first,
then delete the certificate if you want to.
Right-click the file, choose Install Certificate, pick Current User, then Place all certificates in the following store and browse to Trusted Root Certification Authorities. Chrome and Edge use this store. Or, in a terminal:
certutil -addstore -user Root backloop.dev-cert.crtTo undo it, open certmgr.msc, find *.backloop.dev under
Trusted Root Certification Authorities, and delete it.
sudo cp backloop.dev-cert.crt /usr/local/share/ca-certificates/backloop.dev.crt
sudo update-ca-certificatesThat covers curl and most command-line tools. Chrome on Linux keeps its own store, so
add it there too with certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n backloop.dev
-i backloop.dev-cert.crt.
Firefox does not use the system trust store, and it will not accept this certificate as an authority, because it deliberately is not one. Firefox will show a warning and let you add an exception per hostname. If you use Firefox as your main development browser, you will be better served by your own certificate.
The SHA-256 fingerprint of the certificate published here:
openssl x509 -in backloop.dev-cert.crt -noout -fingerprint -sha256| Covers | *.backloop.dev and backloop.dev |
|---|---|
| Expires | 4 September 2036 |
| Type | Self-signed leaf, CA:FALSE, serverAuth only |
Ten years, because rotating costs everyone who installed it a second trip through this page. When the time comes, a replacement is published here and the package announces it at start-up months beforehand.
Better in every way if you can: nobody else holds the key, Firefox works, and there is nothing to trust that you did not create. mkcert sets up a local authority and issues from it:
mkcert -install
mkcert '*.backloop.dev' backloop.devThen point the package at what it produced, and it will not download anything:
export BACKLOOP_DEV_CERT=/path/to/_wildcard.backloop.dev+1.pem
export BACKLOOP_DEV_KEY=/path/to/_wildcard.backloop.dev+1-key.pemA backloop.dev.json file in your project does the same thing, and there are
a couple of other ways to arrange it. The
package
README lists them.