How to set up trusted HTTPS (SSL) on WampServer for Windows

Why run HTTPS on localhost at all?

Plenty of developers run their local sites over plain http:// for years. So why bother with HTTPS on localhost?

Because modern browser features increasingly assume a secure context. These behave differently — or simply refuse to run — over plain HTTP:

• Service workers and the Cache API
• Secure cookies and SameSite=None (needed for many OAuth and SSO flows)
• OAuth/OpenID redirect URIs that require https://
• The Payment Request API, geolocation, camera and microphone access
• HTTP/2, which browsers only negotiate over TLS

If your production app uses any of these, testing over HTTP means testing a different code path than the one your users get. Running trusted HTTPS locally removes that gap.

Why does a self-signed certificate show “Your connection is not private”?

The quick answer: trust is a chain, and a self-signed certificate has no chain.

Your browser trusts a website when its certificate is signed by a Certificate Authority (CA) that your operating system already trusts. A self-signed certificate signs itself — there is no trusted authority vouching for it — so the browser does the correct thing and warns you. Clicking “Proceed anyway (unsafe)” works, but you are training yourself to ignore the exact warning that protects you elsewhere.

The professional fix is not to make a “better” self-signed certificate. It is to create your own small Certificate Authority, tell your computer to trust that authority once, and then sign each site’s certificate with it. That is precisely what the manual steps below do — and what WAMP SSL Automator does for you.

What you need

• WampServer installed and running on Windows 10 or 11. Its bundled Apache ships the openssl.exe used below.
• Administrator rights, because you will write to the Windows certificate store, the hosts file and the Apache config.
• A project served by Apache, for example C:\wamp64\www\myapp\public.

Throughout this guide the example domain is myapp.test. The .test suffix is reserved for testing and will never resolve on the public internet, which makes it ideal for local development.

Option A — the manual way (and where it bites)

Here is the honest version of the by-hand process, so you can see every moving part.

1. Create a local Root CA

Open a terminal where OpenSSL is available (WampServer ships it under C:\wamp64\bin\apache\apache<version>\bin). Generate a CA key and a self-signed CA certificate:

openssl genrsa -out myCA.key 4096
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 3650 -out myCA.crt -subj "/CN=My Local Dev CA"

2. Trust the CA in Windows

Import myCA.crt into the machine’s Trusted Root store. In an elevated PowerShell:

Import-Certificate -FilePath myCA.crt -CertStoreLocation Cert:\LocalMachine\Root

Pitfall: importing into the current-user store instead of LocalMachine\Root, or forgetting to run elevated, leaves the CA untrusted and the warning stays.

3. Issue a certificate for your domain — with a SAN

Modern browsers ignore the old Common Name field and require a Subject Alternative Name plus a serverAuth Extended Key Usage. Create an extensions file myapp.ext:

subjectAltName = DNS:myapp.test
extendedKeyUsage = serverAuth

Then generate a key, a CSR, and sign it with your CA for no more than 825 days:

openssl genrsa -out myapp.key 2048
openssl req -new -key myapp.key -out myapp.csr -subj "/CN=myapp.test"
openssl x509 -req -in myapp.csr -CA myCA.crt -CAkey myCA.key -CAcreateserial -out myapp.crt -days 825 -sha256 -extfile myapp.ext

Pitfall: a missing SAN, a missing serverAuth EKU, or a validity over 825 days will all make Chrome and Edge reject a certificate that otherwise “looks fine”.

4. Configure an Apache SSL vhost

Make sure mod_ssl is enabled, then add a :443 vhost to httpd-vhosts.conf and a :80 redirect:

<VirtualHost *:80>
  ServerName myapp.test
  Redirect permanent / https://myapp.test/
</VirtualHost>

<VirtualHost *:443>
  ServerName myapp.test
  DocumentRoot "C:/wamp64/www/myapp/public"
  SSLEngine on
  SSLCertificateFile "C:/wamp64/certs/myapp.crt"
  SSLCertificateKeyFile "C:/wamp64/certs/myapp.key"
  <Directory "C:/wamp64/www/myapp/public">
    Require local
  </Directory>
</VirtualHost>

Pitfall: one mistyped directive and Apache will not start — taking every site on your stack down until you find it.

5. Map the domain in the hosts file

Edit C:\Windows\System32\drivers\etc\hosts (as Administrator) and add:

127.0.0.1 myapp.test

6. Restart Apache and hope

Restart the wampapache service. If you missed anything in steps 1–5, you find out now — usually with a stack that is offline rather than a helpful message.

It works, but it is a lot of exact, order-sensitive steps, repeated for every new project. That is the gap the tool closes.

Option B — the one-click way

WAMP SSL Automator performs every step above for you, in the correct order, with a safety net:

• It generates and trusts the local Root CA once, then reuses it.
• It issues each domain certificate with the exact SAN + EKU + 825-day profile browsers require.
• It merges the vhost blocks into your existing config instead of overwriting it, and updates the hosts file inside marked sections.
• It runs httpd -t before restarting, and rolls back automatically if anything fails — restoring timestamped backups of both files.
• It fetches each domain over HTTPS afterwards and reports N/N OK.

You add your domains, click Generate SSL Configuration, and watch the log. See the full nine-step pipeline for exactly what runs.

How do I verify HTTPS is working?

Open https://myapp.test in Edge or Chrome. You should see a normal padlock and no warning. To check from the command line:

curl -I https://myapp.test

A trusted response with no certificate error means the chain is good. If you use Firefox, enable security.enterprise_roots.enabled in about:config once so it reads the Windows trust store too.