The disposable Lima profiles use production-shaped TLS by default. Public DNS and trusted Internet certificates are covered separately in Public hosting and Certificates and domains.
Start the trusted local profile
make upThe command provisions the platform, obtains tenant wildcard certificates from the private Pebble CA, enables HTTPS ingress, and trusts that exact CA root in the current macOS user’s login keychain. The control VM forwards its port 443 to host port 8443, producing origins such as:
https://api.ermahgerd.localhost:8443/client/v4
https://photo-gallery.t-bd7662a5eeb4.workers.ermahgerd.localhost:8443macOS resolves the nested .localhost names to loopback. No custom host DNS
service or disabled certificate verification is required. The first run may ask
for authorization to add the CA. Restart a browser that cached an earlier trust
failure.
make site reconverges both platform and HTTPS configuration. make status
shows VM/service state and whether the exact managed CA remains trusted. Add
PROFILE=fleet to use the six-node layout.
Understand lifecycle and trust
make down stops the VM while retaining its disks, certificates, and exact CA
trust. Starting it again therefore requires no new trust decision. make destroy removes the recorded CA trust before deleting the selected local
profile and all of its state.
The trust helper records the CA fingerprint and refuses to claim a matching
certificate it did not install. It never disables browser verification or
modifies system-wide trust. Operator state for that exact trust relationship is
kept under .local/local-https/.
The HTTPS port forward is part of the current Lima templates. If make site
reports that an existing VM predates the forward, destroy and recreate that
disposable profile.
What the local rehearsal proves
Local issuance uses the same certificate manager, Certbot state, deploy hook, atomic HAProxy publication, renewal, and SNI routing shape as the hosted path. Pebble replaces the public CA and supplies a private challenge service, so the test does not consume public rate limits or require a DNS provider API token.
Passing locally demonstrates protocol wiring, certificate validation, hostname rejection, publication, and browser trust. It is not evidence that a public CA will approve a particular domain or that Internet DNS and firewall policy are correct. The hosted profile separately uses public HTTP-01 validation and keeps the administrator portal off public ingress.
Custom-domain behavior is exercised through the same persistent local HTTPS profile. The tenant console’s Worker → Domains workflow provides the TXT proof and routing records. See Custom domains for that workflow and Certificates and domains for the exact-host certificate lifecycle.