Get a certificate with the CLI

Install the current CLI with Homebrew:

brew install lucor/tap/lancert

Or install it from source with Go:

go install go.lucor.dev/lancert-cli/cmd/lancert@latest

Pass the private IPv4 address of your local app:

lancert 192.168.1.50

On the first request, the CLI asks you to accept the certificate authority’s terms. It then prints the hostname and the paths to the certificate and private key.

Certificate issued.
Hostname: quiet-otter.lancert.dev
Certificate: /home/alice/.config/lancert/certs/quiet-otter.lancert.dev/fullchain.pem
Private key: /home/alice/.config/lancert/certs/quiet-otter.lancert.dev/privkey.pem

The certificate covers the assigned hostname and its wildcard. Your ACME account, certificate, and private key stay on your machine.

Use the certificate and private key paths printed by the CLI in your web server configuration.

quiet-otter.lancert.dev, *.quiet-otter.lancert.dev {
    tls /path/to/fullchain.pem /path/to/privkey.pem
    reverse_proxy 127.0.0.1:3000
}

server {
    listen 443 ssl;
    server_name quiet-otter.lancert.dev *.quiet-otter.lancert.dev;

    ssl_certificate     /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;

    location / { proxy_pass http://127.0.0.1:3000; }
}

tls:
  certificates:
    - certFile: /path/to/fullchain.pem
      keyFile: /path/to/privkey.pem

Run the CLI renewal command regularly from cron, systemd, or launchd:

lancert renew

The CLI checks every locally managed certificate and renews those that are due.

Use Lancert’s DNS service with Lego, Certbot, acme.sh, or another compatible client. Open the ACME client guide.