> ## Documentation Index
> Fetch the complete documentation index at: https://sitectl.libops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# certs

> Generate local site certificates and trust their certificate authority on a development workstation.

The `certs` commands support local HTTPS. Generate missing certificate material
through the template's init service, then explicitly trust that site's local
certificate authority on the workstation:

```bash theme={null}
sitectl certs regenerate
sitectl certs trust
```

Generation retains existing keys and certificates. Trust changes the operating
system trust store and can request administrator privileges, so confirm the
active context and inspect `certs/rootCA.pem` first. Production certificates
should use the ingress component's managed or custom-certificate workflow, not
a development certificate authority.

## Reference

Manage the local certificate authority used by site ingress

```bash theme={null}
sitectl certs <command>
```

### `certs regenerate`

Run the shared certificate generator in the Compose init service. Existing keys and certificates are retained; remove them explicitly before requesting replacement.

```bash theme={null}
sitectl certs regenerate
```

| Flag                  | Default                             | Description                                                                                  |
| --------------------- | ----------------------------------- | -------------------------------------------------------------------------------------------- |
| `--ca-subject`        | `/CN=LibOps Local Development CA`   | OpenSSL subject assigned to a newly generated local certificate authority.                   |
| `--service`           | `init`                              | Compose service that mounts the project's certificate directory and contains the generator.  |
| `--subject-alt-names` | `DNS:localhost,IP:127.0.0.1,IP:::1` | Comma-separated OpenSSL DNS and IP subject alternative names placed on the leaf certificate. |

### `certs trust`

Trust certs/rootCA.pem from the active site on this workstation. This changes the local OS trust store and may request administrator privileges on Linux.

```bash theme={null}
sitectl certs trust
```