lpm cert

lpm cert manages the local certificate authority (CA) and project certificates that LPM CLI uses for local HTTPS.

For daily development, enable HTTPS in lpm.json and run lpm dev. Use lpm cert for manual setup and maintenance.

lpm cert <action> [flags]

Quickstart with lpm.json

Add https: true to the lpm.json file next to package.json:

{
  "$schema": "https://cli.lpm.dev/schemas/lpm.json",
  "https": true
}

Start the project:

lpm dev

LPM CLI creates a project certificate and serves the local site through trusted HTTPS. Your application continues to use plain HTTP behind LPM CLI.

On first use, an interactive terminal asks before it installs the local CA. You approve this step only once on each machine.

Use these commands to override the project configuration for one run:

lpm dev --no-https        # disable HTTPS for this run
lpm dev --https           # enable HTTPS for this run
lpm dev --https --yes     # approve CA installation without a prompt

If the CA is not trusted in a non-interactive shell, pass --yes:

lpm dev --yes

You can also install the CA during machine setup. Then the development run does not require trust consent:

lpm cert trust
lpm dev

Use a project hostname

Use proxy.host for one service with a friendly hostname:

{
  "$schema": "https://cli.lpm.dev/schemas/lpm.json",
  "proxy": {
    "host": "app.localhost",
    "port": 9443,
    "httpRedirect": false
  }
}

lpm dev

LPM CLI prepares the certificate and registers the route. Open the URL that lpm dev prints.

If a project has multiple services, use services.<name>.host. Each service must have a different hostname.

The localhost name and names below .localhost do not need a hosts-file entry. Other local names can require a managed hosts-file entry.

See lpm proxy for proxy ports, multiple services, and hosts-file behavior.

Permit more DNS names

The cert block controls which DNS subtrees a project certificate can cover:

{
  "https": true,
  "cert": {
    "extraPermittedDns": ["myapp.internal"],
    "allowPublicDns": false
  }
}

extraPermittedDns does not add a browser hostname or a proxy route. It only permits LPM CLI to issue project certificates below that DNS subtree.

Add the actual browser hostname with proxy.host, services.<name>.host, or lpm cert generate --host.

Each entry must be a bare, multi-label hostname. Do not include a scheme, port, path, wildcard, or leading dot.

By default, LPM CLI accepts these local suffixes:

• .local
• .test
• .localhost
• .internal
• .home.arpa

Public DNS names require an explicit opt-in:

{
  "cert": {
    "extraPermittedDns": ["staging.example.com"],
    "allowPublicDns": true
  }
}

CAUTION: Enable allowPublicDns only for DNS names that you control. This field increases the authority of your local CA.

Examples

lpm dev                                      # use https from lpm.json
lpm cert status                              # show CA and project status
lpm cert trust                               # install the local CA
lpm cert generate                            # create the project certificate
lpm cert generate --host api.app.local       # add a browser hostname
lpm cert rotate --keep-old-trusted 14        # rotate with a 14-day grace period
lpm cert rotate --project ../other-app       # include another project
lpm cert reconcile --dry-run                 # preview rotation cleanup
lpm cert uninstall                           # remove the CA from the trust store

Manual certificate commands

Show certificate status

Run the command from the project directory:

lpm cert status

The output shows the root CA status and the current project certificate. It includes trust, expiry, hostnames, renewal status, and unsafe file permissions.

When fewer than 30 days remain, project certificate renewal starts. When fewer than 60 days remain, root CA warnings start.

Use JSON output in scripts:

lpm cert status --json

The JSON output includes CA data, project data, renewal status, and permission problems.

Repair unsafe permissions

On Unix systems, certificate directories must use mode 0700. Private key files must use mode 0600.

LPM CLI refuses to sign certificates with a group-readable or world-readable CA private key. Run status to get the exact repair command:

lpm cert status

Run the printed chmod command. Then repeat the command that failed.

Trust the root CA

Install the local CA before a non-interactive run. You can also install it before an interactive lpm dev run:

lpm cert trust

If the root CA does not exist, the command creates it. It stores the CA files in ~/.lpm/certs/ and installs the certificate into the system trust store.

You usually run this command once on each development machine.

Remove CA trust

Remove the CA from the system trust store:

lpm cert uninstall

This command keeps the CA files in ~/.lpm/certs/. You can trust the same CA again with lpm cert trust.

The on-disk CA certificate must exist during removal. LPM CLI uses its fingerprint to remove the correct trusted certificate.

Generate a project certificate

If another local tool needs the project certificate files, use generate:

lpm cert trust
lpm cert generate

Run generate from the project directory. It reads the project lpm.json and writes these files:

<project>/.lpm/certs/cert.pem
<project>/.lpm/certs/key.pem

Do not commit these certificate and private key files.

The default certificate names are localhost, 127.0.0.1, and ::1.

Add more Subject Alternative Names (SANs) by repeating --host:

lpm cert generate --host app.local --host api.app.local

generate does not install an untrusted CA. If the CA is not trusted, run lpm cert trust first.

Rotate the root CA

If status reports that the root CA is near expiry, rotate it. If its private key is exposed, rotate the root CA immediately.

lpm cert rotate

Rotation changes the trust identity and reissues known project certificates. Active projects can fail certificate checks during the change.

Use a grace period to keep the old root trusted during a migration:

lpm cert rotate --keep-old-trusted 14

The grace period can be at most 90 days. After the period expires, run lpm cert reconcile to remove the old trust entry.

Add project directories that LPM CLI must reissue:

lpm cert rotate --project ../web --project ../api

By default, rotation skips project directories that no longer exist. If each project must be present, use --fail-on-missing:

lpm cert rotate --project ../web --fail-on-missing

Repair interrupted rotation

Preview certificate cleanup before you change files or trust entries:

lpm cert reconcile --dry-run

Apply the cleanup:

lpm cert reconcile

Use reconcile after an interrupted rotation or after a trust grace period expires. It also removes stale files from unfinished rotation work.

Platform trust stores

LPM CLI identifies trusted certificates by fingerprint. It does not rely only on the certificate name.

Flags

See also

• lpm dev — run the project with local HTTPS
• lpm proxy — route friendly local hostnames
• Local HTTPS — certificate model and file locations
• lpm.json — HTTPS and certificate configuration