CertMon

LOCAL HTTPS FOR MACOS

Zero-config HTTPS
for every local dev server.

Tired of untrusted certificate warnings, self-signed hacks, and broken OAuth redirect URIs? CertMon issues trusted certificates, configures .test DNS, and reverse proxies port 443 straight to your dev ports.

Download free trial Buy · $29

macOS 14+ · 14-day full trial · One license for 3 Macs · 12 months of updates included

$ brew trust suresk/tap
$ brew install --cask suresk/tap/certmon
CertMon dashboard showing active .test domains with green locks and local ports.
CertMon running on macOS with active local HTTPS routes.

01 / ZERO-WARNING TRUST

Real green locks in Safari, Chrome, and curl.

CertMon generates a dedicated local Root CA and stores its private key securely in your macOS Login Keychain—never on disk in plaintext. With one-click trust management, every browser, Node.js script, and curl command trusts your .test domains without special flags or security bypasses.

CertMon Root CA trust status verified in macOS Keychain.
Keychain trust status and one-click health verification.

02 / BUILT-IN REVERSE PROXY & DISCOVERY

Port 443 with WebSocket HMR and path routing.

CertMon listens on standard HTTPS port 443 so you never type port numbers in your address bar again. Full-duplex WebSocket support ensures Vite, Next.js, and Webpack Hot Module Replacement works instantly. Route api.myapp.test to port 8080, or route myapp.test/api to 8080 and myapp.test/ to 3000.

CertMon site routing rules and auto-discovered listening ports.
Route domains and paths to any local port with live auto-discovery.

03 / MOBILE TESTING & TEAM SHARING

Test on real iPhones and share with teammates.

AirDrop an Apple .mobileconfig profile to test on real iOS Safari devices over your local Wi-Fi, or scan a QR code to preview on mobile. Export a .localhttps.json site manifest so your entire engineering team shares the exact same hostnames across projects.

CertMon live request log with timing and one-click copy summary.
Live request log with status codes, latency, and device profile export.

YOUR MAC. TRANSPARENT SECURITY.

Why an optional privileged helper?

Binding port 443 and writing /etc/resolver/test both require root privileges on macOS. Rather than requiring you to run your whole app or dev server with sudo, CertMon uses a tiny, sandboxed launchd daemon.

The helper performs only two operations: forwarding inbound TCP port 443 to CertMon’s proxy and managing the /etc/resolver/test file. It accepts requests only from CertMon binaries signed with the exact same Developer ID. You can inspect its status or uninstall it with one click anytime.

How helper permissions work →

A TOOL YOU OWN

$29 once

Use on 3 Macs. Includes 12 months of updates.
Keep using your version forever after that. Optional updates renewal: $15/year.

14-day full trial. 14-day, no-questions-asked refund policy.

Buy CertMon · $29

Launch offer: 25% off for the first two weeks with LAUNCH25.

Direct download

macOS 14 (Sonoma) or newer. Universal binary for Apple Silicon and Intel Macs. Direct download with automatic updates via Sparkle.

Download CertMon.dmg Buy License · $29

A few good questions.

How is this different from mkcert?

mkcert creates certificate files on disk, but leaves everything else to you: editing /etc/hosts manually for every project, configuring a reverse proxy like Caddy or Nginx, binding port 443, re-configuring every framework’s dev server, and debugging broken WebSockets. CertMon does all of this natively with zero configuration.

Why does CertMon use the .test TLD?

RFC 2606 and RFC 6761 officially reserve .test for testing and development. Unlike .dev and .app (which are public gTLDs owned by Google with hardcoded HSTS preloads), .test will never collide with public internet DNS.

How does the .test DNS resolver work?

macOS has built-in support for per-domain DNS resolvers via /etc/resolver/. CertMon creates a file at /etc/resolver/test directing all queries for *.test to CertMon’s tiny local DNS responder on 127.0.0.1:2053. No VPNs, no network profile modifications, and zero disruption to your normal DNS.

Does WebSocket and Hot Module Replacement (HMR) work?

Yes. CertMon’s reverse proxy supports full-duplex WebSocket tunneling and HTTP/1.1 upgrade handshakes. Vite, Next.js Fast Refresh, webpack-dev-server, and Astro reload smoothly over HTTPS.

Does Firefox trust CertMon certificates?

Firefox uses its own internal certificate store rather than the macOS Keychain by default. To make Firefox trust CertMon (and all other macOS trusted root certificates), open about:config in Firefox and set security.enterprise_roots.enabled to true.

Can I test on my iPhone or iPad?

Yes. From the Trust & Devices tab in CertMon, click "Export iOS Profile" to generate an Apple .mobileconfig profile containing the Root CA certificate. AirDrop it to your iOS device, install it under Settings, enable Full Trust, and your phone will trust your local dev servers over your Wi-Fi network.

Does CertMon collect any telemetry or inspect my traffic?

None. CertMon has zero analytics, zero tracking, and zero telemetry. All certificates, private keys, and HTTP traffic remain strictly on your local machine. The only outbound network requests are Polar license activation and Sparkle update checks.

Why isn’t CertMon in the Mac App Store?

The Mac App Store sandbox forbids binding privileged ports like 443, installing launchd daemons, and managing /etc/resolver/. CertMon is distributed directly and signed with an official Apple Developer ID with Notarization.