NewsPublished 3 Jun 2026

Passkey registration breaks after moving off localhost..

Source Reddit Cybersecurity

Discussion

A user reports that passkey registration using WebAuthn works on localhost but breaks when moving to a custom local domain with a self-signed TLS certificate. The error 'NotAllowedError: WebAuthn is not supported on sites with TLS certificate errors' occurs, indicating that the self-signed certificate is untrusted. The user also notes confusion about the relying party ID (rp_id) and origin settings, as including the port in rp_id is likely incorrect but seems to allow registration. This issue appears related to development environment constraints rather than a direct security vulnerability.

r/cybersecurity (opens in a new tab)u/Sharp_Commercial_1660 points0 comments

Was prototyping passkeys with @ simplewebauthn and everything worked on localhost.

Moved the app to a real domain on the same port (https://testsite.com:3000, added it to my hosts file), and now navigator.credentials.create() throws:

NotAllowedError: WebAuthn is not supported on sites with TLS certificate errors.

The cert is self-signed (openssl, subjectAltName=DNS:testsite.com, serverAuth, etc.). On the server rp_id = testsite.com and rp_origin = https://testsite.com:3000.

Weirdly it does register if I leave the port on the rp_id, which I'm pretty sure is wrong.

Is this purely the self-signed cert being untrusted, or am I also doing the rp_id/origin wrong?

What's the clean way to get passkey registration working on a custom local domain?

Links cited in the discussion

https://testsite.com:3000

Impact

The impact is limited to development and testing environments where self-signed certificates are used. It prevents successful passkey registration due to browser security restrictions on TLS certificate trust. There is no indication of a security vulnerability or exploit in production environments. This is a functional issue affecting developer experience rather than a security threat.

Defensive guidance

Use a valid, trusted TLS certificate for the domain to avoid certificate errors during passkey registration. Avoid including the port number in the relying party ID (rp_id), as this is against WebAuthn standards. For local development, consider using tools that provide trusted local certificates (e.g., mkcert) or configure browsers to trust the self-signed certificate explicitly.

Summary

This issue involves passkey registration failure when transitioning from localhost to a custom local domain using WebAuthn. The failure is caused by the browser rejecting the self-signed TLS certificate, which is required for secure WebAuthn operations. The user observes that including the port in the relying party ID (rp_id) allows registration, though this is against WebAuthn specifications. The root cause is the untrusted self-signed certificate and possibly incorrect rp_id/origin configuration during development.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 3 Jun 2026, 09:03 UTC

Technical details

References

Community reviews