{"id":665,"date":"2021-04-09T16:05:43","date_gmt":"2021-04-09T16:05:43","guid":{"rendered":"https:\/\/localwp.com\/?post_type=help&#038;p=665"},"modified":"2023-07-27T15:23:18","modified_gmt":"2023-07-27T15:23:18","slug":"ssl-in-local","status":"publish","type":"help","link":"https:\/\/localwp.com\/help-docs\/getting-started\/ssl-in-local\/","title":{"rendered":"SSL in Local"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">This doc will go over SSL basics, using SSL in Local, and some common issues. If you are experiencing issues and are also using macOS check out <a href=\"https:\/\/localwp.com\/help-docs\/advanced\/managing-local-sites-ssl-certificate-in-macos\/\"><strong><span style=\"text-decoration: underline;\">this doc<\/span><\/strong><\/a>.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div class=\"wp-block-group help-doc-toc\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\">Table of Contents:<\/p>\n\n\n<nav aria-label=\"Table of Contents\" class=\"wp-block-table-of-contents\"><ol><li><a class=\"wp-block-table-of-contents__entry\" href=\"#what-is-ssl\">What is SSL?<\/a><ol><li><a class=\"wp-block-table-of-contents__entry\" href=\"#ssl-analogy\">SSL Analogy<\/a><\/li><li><a class=\"wp-block-table-of-contents__entry\" href=\"#ssl-for-remote-environments\">SSL for remote environments<\/a><\/li><\/ol><\/li><li><a class=\"wp-block-table-of-contents__entry\" href=\"#local-and-ssl\">Local and SSL<\/a><\/li><li><a class=\"wp-block-table-of-contents__entry\" href=\"#troubleshooting-ssl-in-local\">Troubleshooting SSL in Local<\/a><\/li><li><a class=\"wp-block-table-of-contents__entry\" href=\"#common-ssl-issues-in-local\">Common SSL Issues in Local<\/a><ol><li><a class=\"wp-block-table-of-contents__entry\" href=\"#does-certificate-stay-trusted\">Does the certificate stay &quot;trusted&quot; in Local?<\/a><\/li><li><a class=\"wp-block-table-of-contents__entry\" href=\"#using-bigsur\">Are you using macOS?<\/a><\/li><li><a class=\"wp-block-table-of-contents__entry\" href=\"#manually-access-https-version\">Can you manually access the HTTPS version in a browser?<\/a><\/li><li><a class=\"wp-block-table-of-contents__entry\" href=\"#alternate-browser\">Can you access the site over HTTPS in another browser?<\/a><\/li><li><a class=\"wp-block-table-of-contents__entry\" href=\"#antivirus\">Do you have any antivirus software installed?<\/a><\/li><li><a class=\"wp-block-table-of-contents__entry\" href=\"#chrome-thisisunsafe\">In Chrome, type\u00a0thisisunsafe<\/a><\/li><\/ol><\/li><\/ol><\/nav><\/div><\/div>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading has-text-color\" id=\"what-is-ssl\" style=\"color:#000000\"><strong>What is SSL?<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Secure Sockets Layer (SSL) is a protocol for making secure connections. One of the more common uses of SSL is in conjunction with HTTP, where it&#8217;s called HTTPS. HTTPS stands for &#8220;HTTP&nbsp;<em>over<\/em>&nbsp;SSL.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the most basic level, SSL works by having a server present a&nbsp;<strong>certificate<\/strong>&nbsp;to the browser which helps verify that the server is who it says it is. When working with SSL, you&#8217;ll often hear about&nbsp;<strong>trust<\/strong>&nbsp;and ensuring that the browser &#8220;trusts&#8221; the certificate that a server is using.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This trust is essential because it gives the user a way to be confident that someone else doesn&#8217;t intercept our communication with a site.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"648\" src=\"https:\/\/localwp.com\/wp-content\/uploads\/2021\/04\/localwp-site-with-secure-lock-1024x648.png\" alt=\"A screenshot showing a browser window with the lock icon clicked to view the certificate for the localwp.com site.\" class=\"wp-image-668\" srcset=\"https:\/\/localwp.com\/wp-content\/uploads\/2021\/04\/localwp-site-with-secure-lock-1024x648.png 1024w, https:\/\/localwp.com\/wp-content\/uploads\/2021\/04\/localwp-site-with-secure-lock-300x190.png 300w, https:\/\/localwp.com\/wp-content\/uploads\/2021\/04\/localwp-site-with-secure-lock-768x486.png 768w, https:\/\/localwp.com\/wp-content\/uploads\/2021\/04\/localwp-site-with-secure-lock.png 1335w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading has-text-color\" id=\"ssl-analogy\" style=\"color:#000000\"><strong>SSL Analogy<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Many of those concepts can be abstract, so let&#8217;s look at a real-world analogy that doesn&#8217;t involve computers. Imagine I gave you three pieces of identification to prove who I am:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>A US Passport<\/li>\n\n\n\n<li>A State Driver&#8217;s license<\/li>\n\n\n\n<li>A hand-written badge with my name on it<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">When comparing the name on those pieces of identification against what I say my name is \u2013 which one do you trust more?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I can quickly write my name (or any name!) on a name badge and use that as my &#8220;ID.&#8221; That&#8217;s not the case with a passport or driver&#8217;s license. Going through the effort to get one of those items is more complicated, and as a result, those forms of ID are harder to forge.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You will likely trust the driver&#8217;s license or passport over a hand-written badge. The main reason is that a &#8220;third party&#8221; has verified that I am who I say I am.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It&#8217;s important to remember that just because we trust a hand-written badge less than other forms of identification doesn&#8217;t mean it isn&#8217;t practical!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Think back to any conference or Meetup you&#8217;ve attended. By having participants create their name badges, you get the benefit of quickly identifying strangers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each of the above examples is like an SSL certificate. Just as there are different kinds of ID cards, there are various SSL certificates. When discussing SSL and Local, we&#8217;ll mostly talk about&nbsp;<strong>self-signed certificates<\/strong>, roughly the same as a hand-written badge.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By having Local create and use self-signed certificates, we get the benefit of quickly getting a site to work over HTTPS while not having to pay for and configure a certificate from a third-party&nbsp;<strong>certificate authority<\/strong>.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading has-text-color\" id=\"ssl-for-remote-environments\" style=\"color:#000000\"><strong>SSL for remote environments<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Because Local is an offline development tool, you might wonder how you work with SSL for your live site. To be clear, Local cannot manage the SSL certificates for&nbsp;<em>remote environments<\/em>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You&#8217;ll want to use a certificate from a trusted certificate authority for a production server. Setting this sort of thing up by hand is complicated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The easiest and often the best thing to do is to let a good hosting company handle the setup of SSL for your production sites.&nbsp;<a rel=\"noreferrer noopener\" href=\"https:\/\/getflywheel.com\/why-flywheel\/simple-ssl\/\" target=\"_blank\"><strong><span style=\"text-decoration: underline;\">Flywheel<\/span><\/strong><\/a>&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https:\/\/wpengine.com\/ssl\/\" target=\"_blank\"><strong><span style=\"text-decoration: underline;\">WP Engine<\/span><\/strong><\/a>&nbsp;make configuring SSL on their managed WordPress platforms easy. If you&#8217;re curious and want to know more about what those hosts are doing under the hood, their support documentation is quite helpful:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/wpengine.com\/support\/add-ssl-site\/\"><strong><span style=\"text-decoration: underline;\">WP Engine SSL<\/span><\/strong><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/getflywheel.com\/wordpress-support\/simple-ssl-faq\/\"><strong><span style=\"text-decoration: underline;\">Flywheel SSL<\/span><\/strong><\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">But this help doc is about Local, so let&#8217;s look at how Local manages SSL certificates for&nbsp;<em>local environments<\/em>.<\/p>\n\n\n\n<div style=\"height:40px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading has-text-color\" id=\"local-and-ssl\" style=\"color:#000000\"><strong>Local and SSL<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Local provides a one-click solution for creating and trusting a Local site&#8217;s SSL certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Just click the &#8220;Trust&#8221; button under the &#8220;SSL&#8221; section of the &#8220;Site Overview&#8221; page.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<figure class=\"wp-block-video\"><video height=\"664\" style=\"aspect-ratio: 1012 \/ 664;\" width=\"1012\" controls src=\"https:\/\/localwp.com\/wp-content\/uploads\/2021\/04\/local-ssl-trusting-certificate.mp4\"><\/video><\/figure>\n\n\n\n<div style=\"height:40px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading has-text-color\" id=\"troubleshooting-ssl-in-local\" style=\"color:#000000\"><strong>Troubleshooting SSL in Local<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In most cases, clicking the &#8220;Trust&#8221; link within Local will create and configure the Local site so you can access it over HTTPS. If things go wrong, having a rough checklist of what to inspect is helpful, so let&#8217;s review the tools you have to zero in on the problem.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For any errors you encounter, make a note of the actual error message that the browser reports. They&#8217;ll often be in all caps with underscores. Here are a couple of examples:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ERR_CERT_DATE_INVALID or MOZILLA_PKIK_ERROR_SELF_SIGNED_CERT<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Most browsers will also have some version of an &#8220;Advanced&#8221; button, which you can click for more details. In addition to this, you can manually trust a certificate if you feel comfortable accessing a site that a browser is giving you a warning for.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<figure class=\"wp-block-video\"><video height=\"724\" style=\"aspect-ratio: 1046 \/ 724;\" width=\"1046\" controls src=\"https:\/\/localwp.com\/wp-content\/uploads\/2021\/04\/inspecting-ssl-warning.mp4\"><\/video><\/figure>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">If you want  more details about the certificate, you can click the &#8220;Not Secure&#8221; button to the left of the address bar, or open the &#8220;Security&#8221; tab of the browser dev-tools.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<figure class=\"wp-block-video\"><video height=\"724\" style=\"aspect-ratio: 1046 \/ 724;\" width=\"1046\" controls src=\"https:\/\/localwp.com\/wp-content\/uploads\/2021\/04\/inspecting-ssl-cert-and-debugger.mp4\"><\/video><\/figure>\n\n\n\n<div style=\"height:40px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading has-text-color\" id=\"common-ssl-issues-in-local\" style=\"color:#000000\"><strong>Common SSL Issues in Local<\/strong><\/h2>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading has-text-color\" id=\"does-certificate-stay-trusted\" style=\"color:#000000\"><strong>Does the certificate stay &#8220;trusted&#8221; in Local?<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When troubleshooting, the first thing to check is if Local keeps the SSL certificate as &#8220;Trusted.&#8221; To test this, click to a different site and then click back to the site that&#8217;s having issues. Does Local still think that the certificate is trusted or does the link revert to its original state?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the SSL certificate doesn&#8217;t stay &#8220;Trusted&#8221; within Local, then there&#8217;s likely something that&#8217;s preventing Local from registering the certificate with the computer. This could be some sort of antivirus program or even a security setting put in place by the IT department.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading has-text-color\" id=\"using-bigsur\" style=\"color:#000000\"><strong>Are you using macOS?<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">BigSur and newer versions of macOS and prevent Local from automatically trusting an SSL certificate. We&#8217;re exploring alternate ways to get this to work seamlessly, but in the meantime, you&#8217;ll need to manually trust the site&#8217;s SSL certificate using Keychain. More info about manually managing SSL certs within Mac can be found in <a href=\"https:\/\/localwp.com\/help-docs\/ssl\/managing-local-sites-ssl-certificate-in-macos\/\"><strong><span style=\"text-decoration: underline;\">this help doc.<\/span><\/strong><\/a><\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading has-text-color\" id=\"manually-access-https-version\" style=\"color:#000000\"><strong>Can you manually access the HTTPS version in a browser?<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Just because Local registers a certificate with the computer, doesn&#8217;t mean that it forces the site to use HTTPS. If the site is &#8220;trusted&#8221; in Local, then the next thing to check is if you can manually access the site over HTTPS. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To do this:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Click the &#8220;Open Site&#8221; button in Local<\/li>\n\n\n\n<li>Within the browser that opens, update the url to include&nbsp;<code>https:\/\/<\/code>&nbsp;at the beginning<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">If you are able to access the site over HTTPS, then the only thing left is to update the database to use <code>https:\/\/<\/code> instead of <code>http:\/\/<\/code> using a plugin like <a rel=\"noreferrer noopener\" href=\"https:\/\/wordpress.org\/plugins\/better-search-replace\/\" target=\"_blank\"><strong><span style=\"text-decoration: underline;\">Better Search Replace<\/span><\/strong><\/a> or open a site shell to update the urls with WPCLI:<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">wp search-replace 'http:\/\/example.local' 'https:\/\/example.local'<\/pre>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<figure class=\"wp-block-video\"><video height=\"658\" style=\"aspect-ratio: 1008 \/ 658;\" width=\"1008\" controls src=\"https:\/\/localwp.com\/wp-content\/uploads\/2021\/04\/local-ssl-macos-verify-cert.mp4\"><\/video><\/figure>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading has-text-color\" id=\"alternate-browser\" style=\"color:#000000\"><strong>Can you access the site over HTTPS in another browser?<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;re having issues opening the site over HTTPS in Google Chrome, try opening the site in Firefox. Do you see the same error or a different one?<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading has-text-color\" id=\"antivirus\" style=\"color:#000000\"><strong>Do you have any antivirus software installed?<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">While it doesn&#8217;t happen often, we&#8217;ve seen at least one instance where Avast was altering the SSL certificate that Local was creating. For more info and the back-story about this, check out this&nbsp;<a href=\"https:\/\/localwp.com\/community\/t\/sites-not-accessible-net-err-cert-revoked\/17183\/14?u=ben.turner\"><strong><span style=\"text-decoration: underline;\">topic within the Community Forums<\/span><\/strong><\/a>.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading has-text-color\" id=\"chrome-thisisunsafe\" style=\"color:#000000\"><strong>In Chrome, type&nbsp;<code>thisisunsafe<\/code><\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If all else fails, then within Chrome you can try typing&nbsp;<code>thisisunsafe<\/code>. Yep. That&#8217;s a thing:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/stackoverflow.com\/a\/35275060\"><strong><span style=\"text-decoration: underline;\">https:\/\/stackoverflow.com\/a\/35275060<\/span><\/strong><\/a><\/li>\n<\/ul>\n\n\n\n<div style=\"height:40px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/community.localwp.com\/c\/support\/5\" target=\"_blank\" rel=\"noreferrer noopener\">Get Community Support<\/a><\/div>\n<\/div>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n","protected":false},"excerpt":{"rendered":"<p>This doc will go over SSL basics, using SSL in Local, and some common issues. If you are experiencing issues and are also using macOS check out this doc. Table of Contents: What is SSL? Secure Sockets Layer (SSL) is a protocol for making secure connections. One of the more common uses of SSL is&#8230;<\/p>\n","protected":false},"author":49,"parent":346,"menu_order":9,"template":"","tags":[38,29],"helpcategories":[2],"class_list":["post-665","help","type-help","status-publish","hentry","tag-core-features","tag-ssl","helpcategories-general"],"acf":{"help_keywords":""},"_links":{"self":[{"href":"https:\/\/localwp.com\/wp-json\/wp\/v2\/help-doc\/665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/localwp.com\/wp-json\/wp\/v2\/help-doc"}],"about":[{"href":"https:\/\/localwp.com\/wp-json\/wp\/v2\/types\/help"}],"author":[{"embeddable":true,"href":"https:\/\/localwp.com\/wp-json\/wp\/v2\/users\/49"}],"version-history":[{"count":0,"href":"https:\/\/localwp.com\/wp-json\/wp\/v2\/help-doc\/665\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/localwp.com\/wp-json\/wp\/v2\/help-doc\/346"}],"wp:attachment":[{"href":"https:\/\/localwp.com\/wp-json\/wp\/v2\/media?parent=665"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/localwp.com\/wp-json\/wp\/v2\/tags?post=665"},{"taxonomy":"helpcategories","embeddable":true,"href":"https:\/\/localwp.com\/wp-json\/wp\/v2\/helpcategories?post=665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}