Skip to content

remove section mentioning the CLIs host mode #322

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
quetzalliwrites merged 2 commits into from
Nov 24, 2025
Merged

remove section mentioning the CLIs host mode #322

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cd30dd2
remove section mentioning the CLIs host mode
alexrashed Nov 19, 2025
7b35a0a
update top section, limit to only two options
alexrashed Nov 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 3 additions & 46 deletions src/content/docs/aws/capabilities/security-testing/custom-tls-certificates.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,10 @@ This requires that LocalStack is able to access public URLs.
If there is a proxy server in your network that uses a non-standard TLS certificate, LocalStack will not be able to download any files on demand.
You may see errors in the logs relating to TLS such as "unable to get local issuer certificate".

There are three options when running LocalStack:
There are two options when running LocalStack:

1. [creating a custom Docker image](#creating-a-custom-docker-image),
2. [using init hooks](#custom-tls-certificates-with-init-hooks) or
3. [when running in host mode](#custom-tls-certificates-with-host-mode).
1. [creating a custom Docker image](#creating-a-custom-docker-image) or
2. [using init hooks](#custom-tls-certificates-with-init-hooks)

They all can be summarised as:

Expand Down Expand Up @@ -108,45 +107,3 @@ Then run LocalStack with the environment variables
* `NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt`

and follow the instructions fn the [init hooks documentation](/aws/capabilities/config/initialization-hooks) for configuring LocalStack to use the hook directory as a `boot` hook.

## Custom TLS certificates with host mode

### Linux

On linux the custom certificate should be added to your `ca-certificates` bundle.
For example on Debian based systems (as root):

```bash
# cp <your custom certificate.crt> /usr/local/share/ca-certificates

# update-ca-certificates

```

Then run LocalStack with the environment variables `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, and `NODE_EXTRA_CA_CERTS``:

```bash
NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt \
CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
localstack start --host
```

### macOS

On macOS the custom certificate should be added to your keychain.
See [this Apple support article](https://support.apple.com/en-gb/guide/keychain-access/kyca2431/mac) for more information.

Then run LocalStack with the environment variables `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, and `NODE_EXTRA_CA_CERTS``:

```bash
NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt \
CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
localstack start --host
```

### Windows

Currently host mode does not work with Windows.
If you are using WSL2 you should follow the [Linux](#linux) steps above.