goTLS vs mkcert
Both give you locally-usable HTTPS, but they solve the trust problem in opposite ways: mkcert makes every device trust a CA you install; goTLS uses a CA the whole world already trusts.
mkcert spins up a private certificate authority, installs its root into your system and browser trust stores, and then issues certificates for any name or IP you want. On a single developer machine it's excellent. And it works completely offline.
The friction is trust distribution. Only devices where you've installed the mkcert root CA will trust the certificates. That's fine for your laptop, but awkward-to-impossible for phones, IoT devices, CI runners, appliances, and teammates. Anywhere you can't or don't want to install a custom root.
goTLS issues certificates from a publicly-trusted CA chain, so they're trusted everywhere out of the box, with nothing to install. The private key stays on goTLS's signer, which signs each handshake on demand. The tradeoff is the mirror image of mkcert's: goTLS needs its signer reachable to complete a handshake, where mkcert needs no network at all.
Side by side
| goTLS | mkcert | |
|---|---|---|
| Publicly trusted, no root-CA install | Yes | No — install CA per device |
| Works on phones / IoT / CI / others' machines | Yes | No — only where the CA is installed |
| Works fully offline | No — signer must be reachable | Yes |
| Certificate for any IP / host | Yes (magic-DNS host) | Yes (any name / IP) |
| Key handling | key stays on the signer | your local CA key on disk |
| Setup | run one proxy | install mkcert + its CA on each device |
Which should you use?
Pick mkcert when
- You're on a single machine and want certs that work fully offline.
- You specifically want a local CA you control end to end.
- Everything that needs to trust the certs is a device you administer.
Pick goTLS when
- Multiple or uncontrollable devices are involved: Mobile, IoT, CI, demos, teammates.
- Installing a root CA everywhere is impractical or not allowed.
- You want zero-install, publicly-trusted HTTPS on a private or LAN IP.
mkcert is a fantastic tool and its offline, no-service model is a real advantage. goTLS trades that offline property for zero-install public trust across every device.
Try goTLS
Point the keyless proxy at your service and open the magic URL — trusted everywhere, nothing to install.