diff --git a/manifests/workstation.pp b/manifests/workstation.pp
index 039c123..5416735 100644
--- a/manifests/workstation.pp
+++ b/manifests/workstation.pp
@@ -25,6 +25,7 @@ node default {
   include core::vscode
   include core::emacs
   include core::terminal
+  include core::mkcert
 
   #
   # Add the private puppet module for all the proprietary bits only if the
diff --git a/site-modules/core/manifests/mkcert.pp b/site-modules/core/manifests/mkcert.pp
new file mode 100644
index 0000000..cee8047
--- /dev/null
+++ b/site-modules/core/manifests/mkcert.pp
@@ -0,0 +1,21 @@
+class core::mkcert {
+  archive { "${user_home}/.local/bin/mkcert":
+    ensure        => present,
+    source        => 'https://github.com/FiloSottile/mkcert/releases/download/v1.4.2/mkcert-v1.4.2-linux-amd64',
+    checksum      => 'e116543bfabb4d88010dda8a551a5d01abbdf9b4f2c949c044b862365038f632',
+    checksum_type => 'sha256',
+  }
+
+  exec { 'mkcert permission':
+    command   => "chmod +x ${user_home}/.local/bin/mkcert",
+    path      => '/bin:/usr/bin',
+    subscribe => Archive["${user_home}/.local/bin/mkcert"],
+  }
+
+  exec { 'install root ca':
+    command     => "${user_home}/.local/bin/mkcert -install",
+    environment => [ "HOME=${user_home}" ], 
+    path        => '/bin:/usr/bin',
+    subscribe   => Archive["${user_home}/.local/bin/mkcert"],
+  }
+}