Skip to content

mkcertWeb

v4.2.1 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 10d Developer Productivity
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

authority certificate certificates development https linux
+6 more
localhost macos open-ssl root-ca tls windows

Affected surfaces

auth rbac

Summary

AI summary

Fixed buttons being unclickable due to CSP blocking inline handlers.

Changes in this release

Feature Low

Adds regression tests ensuring CSP retains `script-src-attr 'none'` and forbids inline event handlers.

Adds regression tests ensuring CSP retains `script-src-attr 'none'` and forbids inline event handlers.

Source: llm_adapter@2026-07-17

Confidence: high

 —
Feature Low

Adds tests for deleting archived and active certificates.

Adds tests for deleting archived and active certificates.

Source: llm_adapter@2026-07-17

Confidence: high

 —
Bugfix Medium

Fixes "Install CA in System" failure due to missing CSRF token header.

Fixes "Install CA in System" failure due to missing CSRF token header.

Source: llm_adapter@2026-07-17

Confidence: high

 —
Bugfix Medium

Restores functionality of all inline `onclick` buttons blocked by CSP.

Restores functionality of all inline `onclick` buttons blocked by CSP.

Source: llm_adapter@2026-07-17

Confidence: high

 —
Bugfix Medium

Enables "Delete Forever" on archived certificates, which previously returned 404.

Enables "Delete Forever" on archived certificates, which previously returned 404.

Source: llm_adapter@2026-07-17

Confidence: high

 —
Bugfix Medium

Prevents alert close buttons from breaking when multiple alerts share the same millisecond timestamp.

Prevents alert close buttons from breaking when multiple alerts share the same millisecond timestamp.

Source: llm_adapter@2026-07-17

Confidence: high

 —
Refactor Low

Moves helmet security‑header configuration to `src/config/securityHeaders.js` for testability.

Moves helmet security‑header configuration to `src/config/securityHeaders.js` for testability.

Source: llm_adapter@2026-07-17

Confidence: high

 —
Full changelog

A bugfix release resolving #42 ("Buttons not working") and two further bugs uncovered while verifying the fix. No new features; no API or configuration changes.

Fixed

  • "Install CA in System" always failed with "Invalid CSRF token" (#42). The frontend apiRequest helper spread the caller's options after the constructed headers object in both of its fetch calls, so the one caller that passed a custom headers option (the Install CA handler) silently discarded the X-CSRF-Token header — on the first attempt and on the automatic retry. Options are now spread before the merged headers so the token always survives.
  • Every button wired with an inline onclick="…" attribute was dead (#42): Download Root CA, all certificate-card actions (download cert/key/bundle, generate PFX, archive, restore, delete), alert close buttons, and all five SCEP-page buttons. helmet 8's default CSP directive script-src-attr 'none' blocks inline handler attributes even though script-src allows 'unsafe-inline'. All 14 inline handlers are migrated to addEventListener — certificate cards through a single delegated listener with data-action attributes — and the strict CSP is kept.
  • "Delete Forever" on an archived certificate always returned 404. The archive endpoint moves files into the folder's archive/ subdirectory, but the DELETE route only looked in the folder itself. Latent until now because the button was unclickable under the CSP bug above. The route now checks both locations.
  • Settings-page alert close buttons broke when two alerts appeared in the same millisecond (they share a Date.now()-based element id). Close buttons are now wired to the alert element itself instead of an id lookup.

Added

  • Regression tests: the served CSP must keep script-src-attr 'none' plus the app's directives, and no frontend source may contain an inline event-handler attribute. The helmet options moved to src/config/securityHeaders.js so tests can mount them without booting the server.
  • Tests for deleting archived and active certificates.

Full Changelog: https://github.com/jeffcaldwellca/mkcertWeb/compare/v4.2.0...v4.2.1

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track mkcertWeb

Get notified when new releases ship.

Sign up free

About mkcertWeb

Web based user interface for mkcert CLI internal CA

All releases →

Related context

Beta — feedback welcome: [email protected]