'net::ERR_CERT_AUTHORITY_INVALID' on https://localhost development: how do I get a trusted local certificate with mkcert (and make Node.js trust it)?

Cause: a self-signed or unknown-CA certificate on a local dev server is not trusted by the browser, so it shows ERR_CERT_AUTHORITY_INVALID. Clicking through warnings every time also trains bad habits and breaks features that need a secure context. Node.js is a second problem: it uses its own bundled CA list, not the system store, so curl, browsers and Node can disagree. Fix: 1. Install mkcert and run mkcert -install once. It creates a local certificate authority and adds it to the system trust store (and Firefox's; restart Firefox afterwards). 2. Issue a certificate for the names you use, for example mkcert localhost 127.0.0.1 ::1 myapp.test. It writes a certificate file and a key file in the current directory. Options such as -cert-file and -key-file must come before the names. 3. Point your dev server (Vite, webpack-dev-server, Express, nginx, etc.) at that certificate and key. 4. For Node clients that must trust it, set NODE_EXTRA_CA_CERTS to the rootCA.pem inside the folder printed by mkcert -CAROOT. It must be set before the Node process starts. 5. Keep rootCA-key.pem private and never copy it to other machines or into a repository: whoever has it can issue certificates your machine trusts. To trust the CA on another machine, export only rootCA.pem. 6. Use mkcert only for development. Do not use it, or disable verification (NODE_TLS_REJECT_UNAUTHORIZED=0, curl -k), for production or shared environments; use a public CA such as Let's Encrypt there. Verify: the browser shows a padlock on https://localhost:<port> with no warning, and a Node fetch to the same URL succeeds with TLS verification still on. Sources: https://github.com/FiloSottile/mkcert https://letsencrypt.org/docs/certificates-for-localhost/ https://nodejs.org/api/cli.html