6 days and someone already derailed it to M2 bench wars.
This. Armstrongvds, if your ARM boxes are fleet-managed, push the CA cert through whatever you're using for dotfiles. One shot, then mkcert -install becomes a no-op on new hires.
We do this on Vultr's internal build farm. Same Altra boxes, same problem, same fix.
8 days and nobody's going to touch the Altra tangent, so back to the actual problem
This is where we ended up too but the "one-time trust install" is still a pain on ephemeral CI runners
For the ARM workstations specifically, check whether your config management can handle the trust store differently on Linux vs macOS dev boxes — we hit a fun difference between update-ca-certificates and security add-trusted-cert that broke automation for a week
Has anyone tried Vultr's dev-tier CA tool? Curious if it's worth the switch from self-hosted mkcert
Member
Sorry, that was me derailing my own thread — the ARM tangent was from a different conversation entirely
This is where we ended up too. Puppet drops the CA cert, devs run mkcert -install once, then local.test just works
The one wrinkle: ARM Ampere + mkcert's prebuilt binaries. We hit a fun issue where the downloaded amd64 binary would execute under Rosetta-style emulation but silently fail to modify the trust store. Took a while to notice because the exit code was still 0
Built from source for arm64 and the problem vanished. Might be worth documenting if anyone else is on that path
Has anyone tried the same flow with Vultr's internal CA offering? Curious if it removes the build step entirely or just shifts the complexity elsewhere
Nobody benchmarked it? Disappointing.
Did anyone actually benchmark the Altra against that M2 claim
Also
Contabo's internal CA offering handles the auto-renew via their agent, might be worth a look if mkcert feels too homegrown for your security team
Did anyone actually solve this for the ARM workstations
Oh hey, this went quiet for a month.
I'd actually love to see that too, though for our purposes the per-dev mkcert generation is so fast it barely matters. Armstrongvds, did you end up picking a direction? Curious if the Ampere boxes changed the equation for you at all.
We've since moved our CA rotation into Ansible and it's been smooth. One playbook run when someone joins, then they forget about it.
Been a month so figured I'd check back — did you land on a solution for the team?
Still curious if you benchmarked signing throughput against your old x86 boxes in practice. The 2.2k number gets thrown around a lot but real-world OpenSSL with parallel builds is what actually matters for dev workflows.
If you went the mkcert route, how did the trust store rollout go on the Altra fleet?
Member
Did anyone actually benchmark the Ampere Altra against M2 for OpenSSL throughput?
Also @armstrongvds did you settle on mkcert with shared CA or go a different route? Our team is about to hit the same decision and curious how it scaled
Did anyone actually land on a clean mkcert automation for the ARM Ampere boxes? We're about to roll out a similar fleet and I'd rather not reinvent the trust-store playbook
What does that look like in practice for a fresh workstation — Ansible, a bootstrap script, something else? The root CA distribution part always seems to be the friction point
