I was trying to mirror my setup to prod as much as possible so I only serve my dev site over https. The setup goes like this...

  1. I have a trusted CA on my machine made by devcert

  2. I generated some certs and mounted them in a docker container and serve them on my site, I've added a .dev domain to the /etc/hosts in both the container, my local machine, and my mobile device, all of them get directed to the proper location when I point my browser to the .dev domain


  1. My android mobile device does not trust the certificate. I can't seem to use the chome thisisunsafe hack because I cannot get a keyboard on the warning screen on mobile...

I've tried adding the CA as a trusted certificate on my phone via settings > secutiry > install from SD card but chrome still fails

  1. Firefox (on my local dev machine) doesn't accept the certificate and fails with SEC_ERROR_BAD_SIGNATURE even though chrome works

I badly need to do some mobile debugging so I need to get this in a working condition ASAP, any ideas where I am going wrong?

  • 4
    I recommend to not use *.dev domains. .dev is owned by Google and browsers have HSTS preloaded for this domain so you will never be able to add an explicit exception. Use a domain which is not owned (and policed) by a third party instead. – Steffen Ullrich May 19 '18 at 10:22
  • right, good catch. That was not related to the problem, but I didn't know that – deltaskelta May 21 '18 at 11:16

I ended up going back through the whole process and manually deleting my custom root CA from firefox and clearing the cache. After that everything seemed to be ok

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.