# Certificates

###### LocalCan creates a root Certificate Authority when you install it, and uses it to issue the server certificates that make HTTPS work on your local domains.

To get HTTPS without browser warnings, trust the root CA once. Every server certificate LocalCan generates is signed by it, so trusting the root makes all of them trusted too.

#### Trusting the root certificate

On the machine running LocalCan:

1. In LocalCan, open **Settings** and find **Root Certificate** in the **Local Domains** section.
2. Click **Trust Certificate**.
3. Follow the prompts to add the root CA to your trusted authorities.

Once trusted, any certificate LocalCan generates is recognized on that machine.

#### Other devices and the iOS simulator

To trust the root CA elsewhere, grab the certificate file first:

1. In **Settings**, use **Reveal in Finder** next to **Root Certificate** to locate the file on macOS, or open `~/.localcan/certs/` directly on any platform.
2. **iOS simulator**: drag the file onto the simulator window and follow the prompts to install it.
3. **iPhone or iPad**: AirDrop the file to the device and follow the prompts to install it.

This lets you test your app over HTTPS across devices and simulators.

#### Server certificates

LocalCan generates a server certificate automatically when you add a domain. Each one is wildcard, valid for the apex domain and all its subdomains, so `myapp.local`, `api.myapp.local`, and `www.myapp.local` are all covered. The certificate files live in `~/.localcan/certs/`.

The reverse proxy on port 443 uses these certificates to serve HTTPS. For a [domain-only](/docs/domains/overview#domain-only) setup, where there is no proxy, add the server certificate to your own server if you want it to serve HTTPS, for example when NGINX handles TLS termination in your development setup.