UPDATES & RELEASES

Changelog

Every release of CertMon is documented here. Updates are delivered automatically in-app via Sparkle.

1.0.4 — September 23, 2026

Changed

• Update checks now go to updates.uresk.net and include the app version and license state (trial, licensed, trial ended, or needs attention), which we count per day to see how many copies are in use. Nothing that identifies you is sent or stored; see the privacy page.

1.0.3 — September 23, 2026

Changed

• The license is now required after the trial for adding and changing sites, switching a site on, turning on LAN Mode and exporting device certificates. Sites you already have keep being served, and viewing, switching a site off and deleting it never need a license.
• The menu bar popover shows how many trial days are left near the end, and what to do when the trial is over or a license needs attention.
• License problems are easier to fix: if a key stops validating, the License window says why and offers Try Again, and a key removed from this Mac in the customer portal is re-activated automatically when a slot is free.
• A brief license-server hiccup can no longer mark a paid license as invalid.
• Renewing updates is $9/year.
• Manage License in the dashboard's settings opens the License window again.

1.0.2 — September 19, 2026

A hardening release, recommended for everyone. After updating, CertMon asks you to update its helper and to click Repair Trust once; that is all there is to do.

Security and privacy

• CertMon's root certificate is now limited to .test and .localhost names and this Mac's own loopback addresses (X.509 Name Constraints), so trusting it can never extend to a real website. Earlier roots had no such limit. CertMon makes the new root the first time 1.0.2 runs and retires the old one: click Repair Trust afterwards, and install the profile again on any phone that had the old one.
• The proxy and the DNS responder listen on this Mac only. Earlier versions listened on all network interfaces whatever the LAN Mode switch said. LAN Mode is now off until you turn it on, and reminds you while it is on.
• Sites use a .test or .localhost name and forward to a server on this Mac. Anything else, typed or imported, is declined with an explanation.
• The privileged helper does less and checks more. It manages one resolver file (/etc/resolver/test), builds CertMon's /etc/hosts block itself from your site names, forwards ports 80 and 443 on this Mac only, and leaves /etc/hosts alone if it cannot read it cleanly.
• New: Remove CA & Trust, for a clean uninstall. Regenerating the root now retires the previous one as well.

Improved

• https://yourapp.test works without a port number once the helper is installed. CertMon now sets up .test resolution and port 443 itself, and keeps the /etc/hosts fallback in step with your sites.
• A site you add later is in the HTTPS certificate straight away, and the certificate renews itself well before it expires.
• CertMon starts serving as soon as it launches, without the dashboard being opened.
• The Add and Edit sheets explain when a site cannot be saved.
• Quitting CertMon tidies up: the .test resolver, the hosts block and port 443 are released until the next launch.
• Fixed a crash when a site's port was outside 1 to 65535.

Changed

• The development domain is .test and is no longer a setting.
• The website describes what ships today. HTTP/2, QR codes and a team manifest are not in the app yet.

1.0.0 — September 16, 2026

Initial public release of CertMon for macOS 14 (Sonoma) and macOS 15 (Sequoia).

Features

• Native In-Process Certificate Authority: Pure Swift RFC 5280 ASN.1 DER certificate generator. Creates a P-256 Root CA with private keys securely stored in the macOS Login Keychain.
• One-Click User Keychain Trust: Automatic integration with macOS SecTrustSettingsSetTrustSettings in user domain with zero root Keychain pollution.
• Automatic .test DNS Responder: In-process non-blocking UDP DNS server listening on 127.0.0.1:2053 answering all *.test queries with fallback to managed /etc/hosts.
• Built-In Reverse Proxy on Port 443: TLS termination with HTTP/1.1, full-duplex WebSocket forwarding for Vite and Next.js HMR, and custom 502/404 diagnostic error pages.
• Path-Based Routing: Route multiple backends under a single domain (e.g. /api to 8080, / to 3000).
• Low-Overhead Auto-Discovery: Scans listening dev ports via kernel libproc APIs and offers 1-click site creation with framework detection (Next.js, Vite, Rails, Django, FastAPI).
• Mobile Device Profiles: Export Apple .mobileconfig profiles for iOS trust, and the root certificate as a .crt file for Android.
• Framework Snippet & Cert Exporter: Ready-to-copy HTTPS configurations for Vite, Next.js, Rails Puma, Express, FastAPI, Caddy, and Nginx.
• Team Site Manifest: JSON import and export for .localhttps.json team repo sharing.
• Real-time Request Log: Live circular buffer with HTTP status badges, request timing, and one-click "Copy Summary" for debugging.
• Privileged Helper: Sandboxed launchd daemon for port 443 forwarding and /etc/resolver/test file management.