scripts/cert.mjs

// Creates certs/cert.pem + certs/key.pem: a self-signed RSA-2048 certificate
// for localhost. Browsers will warn once; mkcert (https://github.com/FiloSottile/mkcert)
// installs a local CA instead, so there is no warning at all.
import { execFileSync } from "node:child_process";
import { existsSync, mkdirSync } from "node:fs";

mkdirSync("certs", { recursive: true });
if (existsSync("certs/cert.pem") && existsSync("certs/key.pem")) {
  console.log("certs/ already exists");
} else {
  execFileSync("openssl", [
    // RSA, not EC: macOS's LibreSSL writes EC keys that some TLS stacks reject.
    "req", "-x509", "-newkey", "rsa:2048",
    "-nodes", "-days", "365", "-subj", "/CN=localhost",
    "-addext", "subjectAltName=DNS:localhost,IP:127.0.0.1",
    "-keyout", "certs/key.pem", "-out", "certs/cert.pem",
  ], { stdio: "inherit" });
  console.log("wrote certs/cert.pem and certs/key.pem");
}