---
title: "Local HTTPS"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ermahgerd.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Local HTTPS

The disposable Lima profiles use production-shaped TLS by default. Public DNS
and trusted Internet certificates are covered separately in [Public
hosting](/self-hosted/public-hosting/) and [Certificates and domains](/operations/certificates/).

## Start the trusted local profile

```sh
make up
```

The command provisions the platform, obtains tenant wildcard certificates from
the private Pebble CA, enables HTTPS ingress, and trusts that exact CA root in
the current macOS user's login keychain. The control VM forwards its port 443 to
host port 8443, producing origins such as:

```text
https://api.ermahgerd.localhost:8443/client/v4
https://photo-gallery.t-bd7662a5eeb4.workers.ermahgerd.localhost:8443
```

macOS resolves the nested `.localhost` names to loopback. No custom host DNS
service or disabled certificate verification is required. The first run may ask
for authorization to add the CA. Restart a browser that cached an earlier trust
failure.

`make site` reconverges both platform and HTTPS configuration. `make status`
shows VM/service state and whether the exact managed CA remains trusted. Add
`PROFILE=fleet` to use the six-node layout.

## Understand lifecycle and trust

`make down` stops the VM while retaining its disks, certificates, and exact CA
trust. Starting it again therefore requires no new trust decision. `make
destroy` removes the recorded CA trust before deleting the selected local
profile and all of its state.

The trust helper records the CA fingerprint and refuses to claim a matching
certificate it did not install. It never disables browser verification or
modifies system-wide trust. Operator state for that exact trust relationship is
kept under `.local/local-https/`.

The HTTPS port forward is part of the current Lima templates. If `make site`
reports that an existing VM predates the forward, destroy and recreate that
disposable profile.

## What the local rehearsal proves

Local issuance uses the same certificate manager, Certbot state, deploy hook,
atomic HAProxy publication, renewal, and SNI routing shape as the hosted path.
Pebble replaces the public CA and supplies a private challenge service, so the
test does not consume public rate limits or require a DNS provider API token.

Passing locally demonstrates protocol wiring, certificate validation, hostname
rejection, publication, and browser trust. It is not evidence that a public CA
will approve a particular domain or that Internet DNS and firewall policy are
correct. The hosted profile separately uses public HTTP-01 validation and keeps
the administrator portal off public ingress.

Custom-domain behavior is exercised through the same persistent local HTTPS
profile. The tenant console's **Worker → Domains** workflow provides the TXT
proof and routing records. See [Custom domains](/build/domains/) for that
workflow and [Certificates and domains](/operations/certificates/) for the exact-host
certificate lifecycle.

Source: https://docs.ermahgerd.io/self-hosted/local-https/index.mdx