Fixing Local Self-Signed SSL Certificate Warnings in Chrome & Safari on Mac

Why Browsers Show SSL Warnings for Local Sites

When developing locally over HTTPS (e.g., https://my-app.test), web browsers like Google Chrome, Apple Safari, and Brave enforce strict certificate security. Ad-hoc self-signed certificates trigger prominent security warnings: NET::ERR_CERT_AUTHORITY_INVALID, "Your connection is not private", or "This certificate was signed by an untrusted issuer."

Bypassing these warnings by typing thisisunsafe or clicking "Advanced → Proceed" causes several development issues:

• Service workers, Web Workers, and HTTP/2 features may be restricted or disabled.
• Third-party OAuth redirects and webhook receivers (e.g., Stripe, Shopify) often reject untrusted SSL connections.
• Sub-resource assets (CSS, JS, fetch calls) can be blocked by mixed-content or cross-origin security rules.

How Stratos Solves Local SSL Automatically

Stratos uses an enterprise-grade Local Root Certificate Authority (Local CA) workflow:

1. 4096-Bit Root CA Generation: During initial setup, Stratos generates a dedicated 4096-bit RSA Root Certificate Authority uniquely keyed to your Mac.
2. System Keychain Trust: Stratos adds this certificate to your macOS login Keychain with kSecTrustSettingsResultTrustRoot flags, prompting for your macOS administrator password once.
3. Wildcard SAN Certificates: When serving sites under your development TLD (e.g., .test), Stratos automatically generates and signs SSL certificates containing exact Subject Alternative Name (SAN) extensions for both apex domains and subdomains (e.g., my-app.test and *.my-app.test).

Verifying SSL Trust

Open any linked site in Safari or Google Chrome. You will see a clean green or black lock icon with zero security dialogs, allowing full HTTP/2 and service worker functionality.