Create CA without trying to add it to system store

[iuryr]

I think in some cases it could be useful if mkcert had a flag that would create the Certificate Authority files without trying add it to the system store.

---

My use case

I have a makefile that creates a CA, generates certificates based on this freshly created CA and then proceeds to build and deploy a microservices application through docker-compose.

I'm calling mkcert -install from a Makefile in a machine where I do not have root privileges.
When mkcert -install is called, the system prompts for sudo password. If one presses CTRL + C to send a SIGINT, make captures the signal and does not build the application. Instead, the user has to fail the password check three times so that the build process can continue.

It would be better is, provided user passes a convenient flag to mkcert, it creates the CA in the usual user directory but does not try to install this CA to the system store.

Below, a sample of the makefile that it illustrates the point.

setup:
	mkdir -p certs/client certs/api-gateway certs/auth certs/elasticsearch certs/kibana certs/logstash certs/filebeat certs/ca
	mkcert -install ||\ #User is prompted to enter password here
	cp "$$(mkcert -CAROOT)/rootCA.pem" certs/ca/rootCA.pem && \
	mkcert -cert-file ./certs/api-gateway/cert.pem -key-file ./certs/api-gateway/key.pem localhost && \
	mkcert -cert-file ./certs/auth/cert.pem -key-file ./certs/auth/key.pem localhost auth && \ ...

[imadev26]

Good suggestion! A workaround until this feature is added:

You can use mkcert -install with environment variable to skip the system install:

CAROOT=./certs/ca mkcert -install