FiloSottile
Specify CA Name on mkcert -install
Would like to request the ability to specify a name for the CA certificate's subject common name when running mkcert -install.
Example: mkcert -instal -name 'My Dev CA 01'
The built-in method for generating the CN of the CA certificate uses parenthesis in the name which have to be escaped properly in certain languages, bash as an example.
This is a common request, but I prefer not to make the root customizable for a few reasons:
- The UX is unclear, what happens if you re-run -install without
-nameor with a different-name? Does it destroy the current root? - There are too many customization options, so we'd need full Subject syntax, and probably also something for the names on the leaf certificates
- mkcert is targeted at development. It happens to work as a private CA with one user, but scaling past that with mkcert is not using it for what it's designed, and customizable names encourage that.
If parens are annoying, we can remove them. Can you tell us more about how you're using the root to understand what would work?
That makes sense on wanting to keep it development focused and not customizable. If removing the parentheses is possible then that would be great.
I tried to remember specifically what use case I was testing mkcert with at the time of posting this, but honestly cannot remember. I was probably testing a certificate scenario using a combination of Python/bash and ran into a character escaping problem with the parentheses.
Sometimes we generate certificates that are shared by the team during the development phase，It would be better to allow custom name.
especially in the development phase it customization is important. as developer who thinks about his variable names carefully i would really prefer to set a custom name (and maybe later much more). the custom name would help me in team development and also i would love to name the cert something like AAA.... to keep it at the top of all certs.
from user security point of view we could also argue that a development certificate with an "unknown" name (a name not chosen by myself), can lead to forget such a cert in the browser which could lead to misuse from people who want to do harm.
trying to protect developers is a noble cause but in the end it is annoying most of the time. it leaves an odd feeling as if someone other is thinking for you.
so this is my vote for customizing the name.
