Support Chromium's new NSS DB path on Linux (default since M146)

[lnhrdt]

Summary

On Linux, since Chromium M146, the default NSS shared-DB location moved from ~/.pki/nssdb to ~/.local/share/pki/nssdb. mkcert only searches the old locations, so when a modern Chromium creates its DB at the new path and there's no legacy ~/.pki/nssdb, mkcert -install finds no browser NSS DB and silently skips the Chrome/Chromium trust store. Chrome then rejects mkcert-issued certs with ERR_CERT_AUTHORITY_INVALID.

An environment that previously ran a pre-M146 Chromium already has a ~/.pki/nssdb, so Chromium keeps using it and the problem stays masked. Environments built from scratch such as CI, and use M146+ Chromium, don't have the old ~/.pki/nssdb and hit the failure.

Reference (Chromium docs):

Since M146, Chromium defaults to $HOME/.local/share/pki/nssdb for the NSS Shared DB. If you still have an existing $HOME/.pki/nssdb database, Chromium will use that instead.

https://chromium.googlesource.com/chromium/src/+/main/docs/linux/cert_management.md

Details

mkcert doesn't recognize the new location, so mkcert -install doesn't add the CA there.

Environment

• Linux, Chromium >= 147 (e.g. bundled by Playwright 1.59+, which jumped 145 -> 147)
• Fresh CI environment (clean install every run)
• mkcert v1.4.4

Workaround

Until mkcert searches the new path, create the legacy DB before installing. Chromium uses ~/.pki/nssdb when it exists (per the doc above), and mkcert then has a DB to install the CA into:

mkdir -p "$HOME/.pki/nssdb"
certutil -d "sql:$HOME/.pki/nssdb" -N --empty-password
mkcert -install