Self-signed wildcard SSL certificate for local development

create-wildcard-certificate.sh

#!/usr/bin/env bash

# print usage
DOMAIN=$1
if [ -z "$1" ]; then
    echo "USAGE: $0 tld"
    echo ""
    echo "This will generate a non-secure self-signed wildcard certificate "
    echo "for a given top-level domain (TLD) and thus should only be used "
    echo "for your local development environment."
    exit
fi

# Add wildcard
WILDCARD="*.$DOMAIN"

# Set our variables
cat <<EOF > req.cnf
[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = MD
O = home
localityName = home
commonName = $WILDCARD
organizationalUnitName = home
emailAddress = $(git config user.email)
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1   = https.$DOMAIN
DNS.2   = *.https.$DOMAIN
EOF

# Generate our Private Key, and Certificate directly
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
  -keyout "$DOMAIN.key" -config req.cnf \
  -out "$DOMAIN.crt" -sha256
rm req.cnf

echo ""
echo "Next manual steps:"
echo "- Add the generated $DOMAIN.crt and $DOMAIN.key files to your Apache or Nginx configuration"
echo "- On Linux, import $DOMAIN.crt into your Chrome settings: `chrome://settings/certificates`, 'Authorities' tab"
echo "- On Mac, import $DOMAIN.crt into Keychain Access: System Keychains > System"