diff --git a/client/active.en.toml b/client/active.en.toml
new file mode 100644
index 0000000..4c8a7af
--- /dev/null
+++ b/client/active.en.toml
@@ -0,0 +1,99 @@
+errUnknownGroupCommand = "err. Unknown command \"{{.Name}}\""
+failedDeCodePublicKey = "failed to decode public key"
+failedEnCodePublicKey = "failed to encode public key"
+failedGenCaKey = "failed to generate the CA key"
+help = "Usage of {{.Name}}:\n\t\t\n    $ {{.Name}} auto\n    use guide\n\n    $ {{.Name}} mkcert\n    use mkcert, the same as mkcert's usage.\n\n"
+moreOptions = "For more options, run \"mkcert -help\"."
+scan10 = "failed to encode certificate key"
+scan11 = "failed to save certificate and key"
+scan12 = "failed to save certificate"
+scan13 = "failed to save certificate key"
+scan14 = "failed to generate PKCS#12"
+scan15 = "failed to save PKCS#12"
+scan16 = "\nThe certificate and key are at \"%s\" ✅\n\n"
+scan17 = "\nThe certificate is at \"%s\" and the key at \"%s\" ✅\n\n"
+scan18 = "\nThe PKCS#12 bundle is at \"%s\" ✅\n"
+scan19 = "\nThe legacy PKCS#12 encryption password is the often hardcoded default \"changeit\" ℹ️\n\n"
+scan20 = "It will expire on %s 🗓\n\n"
+scan21 = "\nCreated a new certificate valid for the following names 📜"
+scan22 = " - %q"
+scan23 = "   Warning: many browsers don't support second-level wildcards like %q ⚠️"
+scan24 = "\nReminder: X.509 wildcards only go one level deep, so this won't match a.b.%s ℹ️"
+scan25 = "failed to generate serial number"
+scan26 = "failed to read the CSR"
+scan27 = "ERROR: failed to read the CSR: unexpected content"
+scan28 = "failed to parse the CSR"
+scan29 = "invalid CSR signature"
+scan30 = "failed to parse generated certificate"
+scan31 = "\nThe certificate is at \"%s\" ✅\n\n"
+scan32 = "failed to read the CA certificate"
+scan33 = "ERROR: failed to read the CA certificate: unexpected content"
+scan34 = "failed to parse the CA certificate"
+scan35 = "failed to read the CA key"
+scan36 = "ERROR: failed to read the CA key: unexpected content"
+scan37 = "failed to parse the CA key"
+scan38 = "failed to generate the CA key"
+scan39 = "failed to encode public key"
+scan40 = "failed to decode public key"
+scan41 = "failed to generate CA certificate"
+scan42 = "failed to encode CA key"
+scan43 = "failed to save CA key"
+scan44 = "failed to save CA certificate"
+scan45 = "Created a new local CA 💥\n"
+scan46 = "Exported to the current directory"
+scan47 = "The credit client has been generated and is currently in the dist directory. Please deploy it on your server."
+scan48 = "The local CA is already installed in the system trust store! 👍"
+scan49 = "Root certificate client generated automkcert-root 💥\n"
+scan50 = "ERROR: you can't set -[un]install and -CAROOT at the same time"
+scan51 = "ERROR: you can't set -install and -uninstall at the same time"
+scan52 = "ERROR: can only combine -csr with -install and -cert-file"
+scan53 = "ERROR: can't specify extra arguments when using -csr"
+scan54 = "ERROR: failed to find the default CA location, set one as the CAROOT env var"
+scan55 = "failed to create the CAROOT"
+scan56 = "Note: the local CA is not installed in the system trust store."
+scan57 = "Note: the local CA is not installed in the %s trust store."
+scan58 = "Note: the local CA is not installed in the Java trust store."
+scan59 = "Run \"mkcert -install\" for certificates to be trusted automatically ⚠️"
+scan60 = "ERROR: %q is not a valid hostname, IP, URL or email: %s"
+scan61 = "ERROR: %q is not a valid hostname, IP, URL or email"
+scan62 = "The local CA is now installed in the system trust store! ⚡️"
+scan63 = "The local CA is already installed in the %s trust store! 👍"
+scan64 = "The local CA is now installed in the %s trust store (requires browser restart)! 🦊"
+scan65 = "Note: %s support is not available on your platform. ℹ️"
+scan66 = "Warning: \"certutil\" is not available, so the CA can't be automatically installed in %s! ⚠️"
+scan67 = "Install \"certutil\" with \"%s\" and re-run \"mkcert -install\" 👈"
+scan68 = "The local CA is already installed in Java's trust store! 👍"
+scan69 = "The local CA is now installed in Java's trust store! ☕️"
+scan7 = "ERROR: can't create new certificates because the CA key (rootCA-key.pem) is missing"
+scan70 = "Warning: \"keytool\" is not available, so the CA can't be automatically installed in Java's trust store! ⚠️"
+scan72 = "Warning: \"certutil\" is not available, so the CA can't be automatically uninstalled from %s (if it was ever installed)! ⚠️"
+scan73 = "You can install \"certutil\" with \"%s\" and re-run \"mkcert -uninstall\" 👈"
+scan74 = "Warning: \"keytool\" is not available, so the CA can't be automatically uninstalled from Java's trust store (if it was ever installed)! ⚠️"
+scan75 = "The local CA is now uninstalled from the system trust store(s)! 👋"
+scan76 = "The local CA is now uninstalled from the %s trust store(s)! 👋"
+scan77 = "ERROR: %s: %s"
+scan78 = "ERROR: failed to execute \"%s\": %s\n\n%s\n"
+scan79 = "Warning: \"sudo\" is not available, and mkcert is not running as root. The (un)install operation might fail. ⚠️"
+scan8 = "failed to generate certificate key"
+scan80 = "failed to create temp file"
+scan81 = "failed to read trust settings"
+scan82 = "failed to parse trust settings"
+scan83 = "ERROR: unsupported trust settings version:"
+scan84 = "failed to serialize trust settings"
+scan85 = "failed to write trust settings"
+scan86 = "Installing to the system store is not yet supported on this Linux 😣 but %s will still work."
+scan87 = "You can also manually install the root certificate at %q."
+scan88 = "failed to read root certificate"
+scan89 = "ERROR: no %s security databases found"
+scan9 = "failed to generate certificate"
+scan90 = "Installing in %s failed. Please report the issue with details about your environment at https://github.com/FiloSottile/mkcert/issues/new 👎"
+scan91 = "Note that if you never started %s, you need to do that at least once."
+scan92 = "decode pem"
+scan93 = "open root store"
+scan94 = "add cert"
+scan95 = "delete cert"
+shortUsage = "Usage of mkcert:\n\n\t$ mkcert -install\n\tInstall the local CA in the system trust store.\n\n\t$ mkcert example.org\n\tGenerate \"example.org.pem\" and \"example.org-key.pem\".\n\n\t$ mkcert example.com myapp.dev localhost 127.0.0.1 ::1\n\tGenerate \"example.com+4.pem\" and \"example.com+4-key.pem\".\n\n\t$ mkcert \"*.example.it\"\n\tGenerate \"_wildcard.example.it.pem\" and \"_wildcard.example.it-key.pem\".\n\n\t$ mkcert -uninstall\n\tUninstall the local CA (but do not delete it).\n\n"
+
+[advancedUsage]
+description = "this is advancedUsage"
+other = "Advanced options:\n\n\t-cert-file FILE, -key-file FILE, -p12-file FILE\n\t\tCustomize the output paths.\n\n\t-client\n\t\tGenerate a certificate for client authentication.\n\n\t-ecdsa\n\t\tGenerate a certificate with an ECDSA key.\n\n\t-pkcs12\n\t\tGenerate a \".p12\" PKCS #12 file, also know as a \".pfx\" file,\n\t\tcontaining certificate and key for legacy applications.\n\n\t-csr CSR\n\t\tGenerate a certificate based on the supplied CSR. Conflicts with\n\t\tall other flags and arguments except -install and -cert-file.\n\n\t-CAROOT\n\t\tPrint the CA certificate and key storage location.\n\n\t$CAROOT (environment variable)\n\t\tSet the CA certificate and key storage location. (This allows\n\t\tmaintaining multiple local CAs in parallel.)\n\n\t$TRUST_STORES (environment variable)\n\t\tA comma-separated list of trust stores to install the local\n\t\troot CA into. Options are: \"system\", \"java\" and \"nss\" (includes\n\t\tFirefox). Autodetected by default.\n\n"
diff --git a/client/active.zh.toml b/client/active.zh.toml
new file mode 100644
index 0000000..59801d4
--- /dev/null
+++ b/client/active.zh.toml
@@ -0,0 +1,99 @@
+errUnknownGroupCommand = "错误. 未知的命令 \"{{.Name}}\""
+failedDeCodePublicKey = "无法解码公钥"
+failedEnCodePublicKey = "未能对公钥进行编码"
+failedGenCaKey = "无法生成CA密钥"
+help = "{{.Name}}的用法:\n\t\t\n    $ {{.Name}} auto\n    使用向导\n\n    $ {{.Name}} mkcert\n    使用 mkcert, 跟原版 mkcert 用法一致.\n\n"
+moreOptions = "有关更多选项，请运行“mkcert-help”。"
+scan10 = "无法对证书密钥进行编码"
+scan11 = "无法保存证书和密钥"
+scan12 = "无法保存证书"
+scan13 = "未能保存证书密钥"
+scan14 = "未能生成PKCS#12"
+scan15 = "未能保存PKCS#12"
+scan16 = "\n证书和密钥位于 \"%s\" ✅\n\n"
+scan17 = "\n证书位于 \"%s\" and the key at \"%s\" ✅\n\n"
+scan18 = "\nPKCS#12捆绑包位于 \"%s\" ✅\n"
+scan19 = "\n传统的PKCS#12加密密码通常是硬编码的默认密码\"改变它\" ℹ️\n\n"
+scan20 = "它将于 %s 到期🗓\n\n"
+scan21 = "\n创建了对以下名称有效的新证书 📜"
+scan22 = " - %q"
+scan23 = "   警告：许多浏览器不支持二级通配符，如 %q ⚠️"
+scan24 = "\n提醒：X.509通配符只深入一级，因此与a.b不匹配。%s ℹ️"
+scan25 = "无法生成序列号"
+scan26 = "未能读取CSR"
+scan27 = "错误：无法读取CSR:意外内容"
+scan28 = "无法分析CSR"
+scan29 = "CSR签名无效"
+scan30 = "无法分析生成的证书"
+scan31 = "\n证书位于 \"%s\" ✅\n\n"
+scan32 = "无法读取CA证书"
+scan33 = "错误：无法读取CA证书：意外内容"
+scan34 = "无法分析CA证书"
+scan35 = "无法读取CA密钥"
+scan36 = "错误：无法读取CA密钥：意外内容"
+scan37 = "无法分析CA密钥"
+scan38 = "无法生成CA密钥"
+scan39 = "未能对公钥进行编码"
+scan40 = "未能对公钥进行解码"
+scan41 = "无法生成CA证书"
+scan42 = "无法对CA密钥进行编码"
+scan43 = "保存CA密钥失败"
+scan44 = "保存CA证书失败"
+scan45 = "创建了一个新的本地CA 💥\n"
+scan46 = "已导出到当前目录下"
+scan47 = "已生成授信客户端，在当前dist目录下，请在你的服务器进行部署"
+scan48 = "本地CA已安装在系统信任存储中！ 👍"
+scan49 = "生成了根证书客户端automkcert-root 💥\n"
+scan50 = "错误：不能同时设置-[un]install和-CAROOT"
+scan51 = "错误：不能同时设置-install和-uninstall"
+scan52 = "错误：只能将-csr与-install和-cert文件结合使用"
+scan53 = "错误：使用-csr时无法指定额外的参数"
+scan54 = "错误：找不到默认的CA位置，将其设置为CAROOT env var"
+scan55 = "未能创建CAROOT"
+scan56 = "注意：本地CA未安装在系统信任存储中。"
+scan57 = "注意：本地CA未安装在%s信任存储中。"
+scan58 = "注意：本地CA未安装在Java信任存储中。"
+scan59 = "运行“mkcert-install”以自动信任证书 ⚠️"
+scan60 = "错误：%q不是有效的主机名、IP、URL或电子邮件：%s"
+scan61 = "错误：%q不是有效的主机名、IP、URL或电子邮件"
+scan62 = "本地CA现在已安装在系统信任存储中！ ⚡️"
+scan63 = "本地CA已安装在%s信任存储中！ 👍"
+scan64 = "本地CA现在已安装在%s信任存储中（需要重新启动浏览器）！ 🦊"
+scan65 = "注意：%s支持在您的平台上不可用。 ℹ️"
+scan66 = "警告：“certutil”不可用，因此CA无法自动安装在%s中！ ⚠️"
+scan67 = "使用“%s”安装“certutil”，然后重新运行“mkcert-Install”👈"
+scan68 = "本地CA已安装在Java的信任存储中！ 👍"
+scan69 = "本地CA现在已安装在Java的信任存储中！☕️"
+scan7 = "错误：无法创建新证书，因为CA密钥（rootCA密钥.pem）丢失"
+scan70 = "警告：“keytool”不可用，因此CA无法自动安装在Java的信任存储中！⚠️"
+scan72 = "警告：“certutil”不可用，因此CA无法从%s自动卸载（如果已安装）！⚠️"
+scan73 = "您可以将“certutil”与“%s”一起安装，然后重新运行“mkcert-uninstall” 👈"
+scan74 = "警告：“keytool”不可用，因此CA无法从Java的信任存储中自动卸载（如果已安装）! ⚠️"
+scan75 = "本地CA现在已从系统信任存储中卸载! 👋"
+scan76 = "本地CA现在已从%s信任存储中卸载！ 👋"
+scan77 = "错误: %s: %s"
+scan78 = "错误：无法执行 \"%s\": %s\n\n%s\n"
+scan79 = "警告：“sudo”不可用，并且mkcert没有以root身份运行。（取消）安装操作可能会失败。 ⚠️"
+scan8 = "无法生成证书密钥"
+scan80 = "无法创建临时文件"
+scan81 = "无法读取信任设置"
+scan82 = "无法分析信任设置"
+scan83 = "错误：不支持的信任设置版本："
+scan84 = "无法序列化信任设置"
+scan85 = "无法写入信任设置"
+scan86 = "此Linux尚不支持安装到系统存储😣 但%s仍然有效。"
+scan87 = "您也可以在%q手动安装根证书."
+scan88 = "无法读取根证书"
+scan89 = "错误：找不到%s安全数据库"
+scan9 = "无法生成证书"
+scan90 = "在%s中安装失败。请在上报告此问题并提供有关您的环境的详细信息 https://github.com/FiloSottile/mkcert/issues/new 👎"
+scan91 = "请注意，如果您从未启动%s，则需要至少启动一次。"
+scan92 = "解码pem"
+scan93 = "打开根存储"
+scan94 = "增加证书"
+scan95 = "删除证书"
+shortUsage = "mkcert 的用法：\n\n\t$ mkcert -install\n\t在系统信任存储中安装本地 CA。\n\n\t$ mkcert example.org\n\t生成 \"example.org.pem\" 和 \"example.org-key.pem\"。\n\n\t$ mkcert example.com myapp.dev localhost 127.0.0.1 ::1\n\t生成 \"example.com+4.pem\" 和 \"example.com+4-key.pem\"。\n\n\t$ mkcert \"*.example.it\"\n\t生成 \"_wildcard.example.it.pem\" 和 \" _wildcard.example.it-key.pem\"。\n\n\t$ mkcert -uninstall\n\t卸载本地 CA（但不删除它）。\n\n"
+
+[advancedUsage]
+description = "这是高级用法"
+other = "高级选项:\n\n\t-cert-file FILE、-key-file FILE、-p12-file FILE\n\t\t自定义输出路径。\n\n\t-client\n\t\t生成 用于客户端身份验证的证书。\n\n\t-ecdsa\n\t\t使用 ECDSA 密钥生成证书。\n\n\t-pkcs12\n\t\t生成 \".p12\" PKCS # 12 文件，也称为“.pfx”文件，\n\t\t包含旧应用程序的证书和密钥。\n\n\t-csr CSR\n\t\t根据提供的 CSR 生成证书 。 与除 -install 和 -cert-file 之外的\n\t\t所有其他标志和参数冲突。\n\n\t-CAROOT\n\t\t打印 CA 证书和密钥存储位置。\n\n\t$ CAROOT（环境变量）\n\t\t设置 CA 证书和密钥存储位置。 （这允许\n\t\t并行维护多个本地 CA。）\n\n\t$TRUST_STORES（环境变量）\n\t\t用于安装本地 CA 的以逗号分隔的信任存储列表\n\t\troot CA 进入。 选项有：\"system\"、\"java\" 和 \"nss\"（包括\n\t\tFirefox）。 默认情况下自动检测。\n\n"
\ No newline at end of file
diff --git a/client/client.go b/client/client.go
index 03027f1..34c4743 100644
--- a/client/client.go
+++ b/client/client.go
@@ -16,13 +16,13 @@ import (
 const rootName = "rootCA.pem"
 
 type mkcert struct {
-	CAROOT string
-	caCert *x509.Certificate
+	CAROOT	string
+	caCert	*x509.Certificate
 
 	// The system cert pool is only loaded once. After installing the root, checks
 	// will keep failing until the next execution. TODO: maybe execve?
 	// https://github.com/golang/go/issues/24540 (thanks, myself)
-	ignoreCheckFailure bool
+	ignoreCheckFailure	bool
 }
 
 func (m *mkcert) checkPlatform() bool {
@@ -37,41 +37,68 @@ func (m *mkcert) checkPlatform() bool {
 func (m *mkcert) install() {
 	if storeEnabled("system") {
 		if m.checkPlatform() {
-			log.Print("The local CA is already installed in the system trust store! 👍")
+			log.Print(i18nText.
+				scan95,
+			)
 		} else {
 			if m.installPlatform() {
-				log.Print("The local CA is now installed in the system trust store! ⚡️")
+				log.Print(i18nText.
+					scan95,
+				)
 			}
-			m.ignoreCheckFailure = true // TODO: replace with a check for a successful install
+			m.ignoreCheckFailure = true	// TODO: replace with a check for a successful install
 		}
 	}
 	if storeEnabled("nss") && hasNSS {
 		if m.checkNSS() {
-			log.Printf("The local CA is already installed in the %s trust store! 👍", NSSBrowsers)
+			log.Printf(i18nText.
+				scan95,
+
+				NSSBrowsers)
 		} else {
 			if hasCertutil && m.installNSS() {
-				log.Printf("The local CA is now installed in the %s trust store (requires browser restart)! 🦊", NSSBrowsers)
+				log.Printf(i18nText.
+					scan95,
+
+					NSSBrowsers)
 			} else if CertutilInstallHelp == "" {
-				log.Printf(`Note: %s support is not available on your platform. ℹ️`, NSSBrowsers)
+				log.Printf(i18nText.
+					scan65,
+
+					NSSBrowsers)
 			} else if !hasCertutil {
-				log.Printf(`Warning: "certutil" is not available, so the CA can't be automatically installed in %s! ⚠️`, NSSBrowsers)
-				log.Printf(`Install "certutil" with "%s" and re-run "mkcert -install" 👈`, CertutilInstallHelp)
+				log.Printf(i18nText.
+					scan66,
+
+					NSSBrowsers)
+				log.Printf(i18nText.
+					scan67,
+
+					CertutilInstallHelp)
 			}
 		}
 	}
 	if storeEnabled("java") && hasJava {
 		if m.checkJava() {
-			log.Println("The local CA is already installed in Java's trust store! 👍")
+			log.Println(i18nText.
+				scan95,
+			)
 		} else {
 			if hasKeytool {
 				m.installJava()
-				log.Println("The local CA is now installed in Java's trust store! ☕️")
+				log.Println(i18nText.
+					scan95,
+				)
 			} else {
-				log.Println(`Warning: "keytool" is not available, so the CA can't be automatically installed in Java's trust store! ⚠️`)
+				log.Println(i18nText.
+					scan70,
+				)
 			}
 		}
 	}
-	log.Print("")
+	log.Print(i18nText.
+		scan95,
+	)
 }
 
 func (m *mkcert) uninstall() {
@@ -79,33 +106,58 @@ func (m *mkcert) uninstall() {
 		if hasCertutil {
 			m.uninstallNSS()
 		} else if CertutilInstallHelp != "" {
-			log.Print("")
-			log.Printf(`Warning: "certutil" is not available, so the CA can't be automatically uninstalled from %s (if it was ever installed)! ⚠️`, NSSBrowsers)
-			log.Printf(`You can install "certutil" with "%s" and re-run "mkcert -uninstall" 👈`, CertutilInstallHelp)
-			log.Print("")
+			log.Print(i18nText.
+				scan95,
+			)
+			log.Printf(i18nText.
+				scan72,
+
+				NSSBrowsers)
+			log.Printf(i18nText.
+				scan73,
+
+				CertutilInstallHelp)
+			log.Print(i18nText.
+				scan95,
+			)
 		}
 	}
 	if storeEnabled("java") && hasJava {
 		if hasKeytool {
 			m.uninstallJava()
 		} else {
-			log.Print("")
-			log.Println(`Warning: "keytool" is not available, so the CA can't be automatically uninstalled from Java's trust store (if it was ever installed)! ⚠️`)
-			log.Print("")
+			log.Print(i18nText.
+				scan95,
+			)
+			log.Println(i18nText.
+				scan74,
+			)
+			log.Print(i18nText.
+				scan95,
+			)
 		}
 	}
 	if storeEnabled("system") && m.uninstallPlatform() {
-		log.Print("The local CA is now uninstalled from the system trust store(s)! 👋")
-		log.Print("")
+		log.Print(i18nText.
+			scan95,
+		)
+		log.Print(i18nText.
+			scan95,
+		)
 	} else if storeEnabled("nss") && hasCertutil {
-		log.Printf("The local CA is now uninstalled from the %s trust store(s)! 👋", NSSBrowsers)
-		log.Print("")
+		log.Printf(i18nText.
+			scan95,
+
+			NSSBrowsers)
+		log.Print(i18nText.
+			scan95,
+		)
 	}
 }
 
 type item struct {
-	Name        string
-	Description string
+	Name		string
+	Description	string
 }
 
 func (m *mkcert) caUniqueName() string {
@@ -127,10 +179,10 @@ func main() {
 	}
 
 	templates := &promptui.SelectTemplates{
-		Label:    "{{ . }}?",
-		Active:   "\U0001F336 {{ .Name | cyan }}",
-		Inactive: "  {{ .Name | cyan }}",
-		Selected: "\U0001F336 {{ .Name | red | cyan }}",
+		Label:		"{{ . }}?",
+		Active:		"\U0001F336 {{ .Name | cyan }}",
+		Inactive:	"  {{ .Name | cyan }}",
+		Selected:	"\U0001F336 {{ .Name | red | cyan }}",
 		Details: `
 --------- 详情 ----------
 {{ "名字:" | faint }}	{{ .Name }}
@@ -146,27 +198,33 @@ func main() {
 	}
 
 	prompt := promptui.Select{
-		Label:     "当前是授信客户端,你要做什么",
-		Items:     items,
-		Templates: templates,
-		Size:      4,
-		Searcher:  searcher,
+		Label:		"当前是授信客户端,你要做什么",
+		Items:		items,
+		Templates:	templates,
+		Size:		4,
+		Searcher:	searcher,
 	}
 
 	i, _, err := prompt.Run()
 
 	if err != nil {
 		fmt.Printf("Prompt failed %v\n", err)
-		log.Fatalln("选择错误")
+		log.Fatalln(i18nText.
+			scan95,
+		)
 	} else {
 		m := &mkcert{}
 		m.CAROOT = "./"
 		certDERBlock, _ := pem.Decode(cert)
 		if certDERBlock == nil || certDERBlock.Type != "CERTIFICATE" {
-			log.Fatalln("ERROR: failed to read the CA certificate: unexpected content")
+			log.Fatalln(i18nText.
+				scan95,
+			)
 		}
 		m.caCert, err = x509.ParseCertificate(certDERBlock.Bytes)
-		fatalIfErr(err, "failed to parse the CA certificate")
+		fatalIfErr(err, i18nText.
+			scan95,
+		)
 		if i == 0 {
 			m.install()
 		} else if i == 1 {
diff --git a/client/func.go b/client/func.go
index 0a68f88..85212d4 100644
--- a/client/func.go
+++ b/client/func.go
@@ -17,7 +17,9 @@ func commandWithSudo(cmd ...string) *exec.Cmd {
 	}
 	if !binaryExists("sudo") {
 		sudoWarningOnce.Do(func() {
-			log.Println(`Warning: "sudo" is not available, and mkcert is not running as root. The (un)install operation might fail. ⚠️`)
+			log.Println(i18nText.
+				scan79,
+			)
 		})
 		return exec.Command(cmd[0], cmd[1:]...)
 	}
@@ -26,7 +28,10 @@ func commandWithSudo(cmd ...string) *exec.Cmd {
 
 func fatalIfCmdErr(err error, cmd string, out []byte) {
 	if err != nil {
-		log.Fatalf("ERROR: failed to execute \"%s\": %s\n\n%s\n", cmd, err, out)
+		log.Fatalf(i18nText.
+			scan95,
+
+			cmd, err, out)
 	}
 }
 
@@ -55,6 +60,9 @@ func storeEnabled(name string) bool {
 
 func fatalIfErr(err error, msg string) {
 	if err != nil {
-		log.Fatalf("ERROR: %s: %s", msg, err)
+		log.Fatalf(i18nText.
+			scan95,
+
+			msg, err)
 	}
 }
diff --git a/client/go.mod b/client/go.mod
index 14e72c1..80856e9 100644
--- a/client/go.mod
+++ b/client/go.mod
@@ -3,11 +3,17 @@ module jieshao/automkcertclient
 go 1.21.4
 
 require (
+	github.com/BurntSushi/toml v1.3.2
+	github.com/cloudfoundry/jibber_jabber v0.0.0-20151120183258-bcc4c8345a21
 	github.com/manifoldco/promptui v0.9.0
+	github.com/nicksnyder/go-i18n/v2 v2.3.0
+	golang.org/x/text v0.14.0
 	howett.net/plist v1.0.1
 )
 
 require (
 	github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e // indirect
-	golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b // indirect
+	github.com/onsi/ginkgo v1.16.5 // indirect
+	github.com/onsi/gomega v1.30.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
 )
diff --git a/client/go.sum b/client/go.sum
index 21e8fc7..bad4bd4 100644
--- a/client/go.sum
+++ b/client/go.sum
@@ -1,15 +1,106 @@
+github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
+github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/chzyer/logex v1.1.10 h1:Swpa1K6QvQznwJRcfTfQJmTE72DqScAa40E+fbHEXEE=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e h1:fY5BOSpyZCqRo5OhCuC+XN+r/bBCmeuuJtjz+bCNIf8=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1 h1:q763qf9huN11kDQavWsoZXJNW3xEE4JJyHa5Q25/sd8=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cloudfoundry/jibber_jabber v0.0.0-20151120183258-bcc4c8345a21 h1:tuijfIjZyjZaHq9xDUh0tNitwXshJpbLkqMOJv4H3do=
+github.com/cloudfoundry/jibber_jabber v0.0.0-20151120183258-bcc4c8345a21/go.mod h1:po7NpZ/QiTKzBKyrsEAxwnTamCoh8uDk/egRpQ7siIc=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/manifoldco/promptui v0.9.0 h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
 github.com/manifoldco/promptui v0.9.0/go.mod h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg=
-golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b h1:MQE+LT/ABUuuvEZ+YQAMSXindAdUh7slEmAkup74op4=
+github.com/nicksnyder/go-i18n/v2 v2.3.0 h1:2NPsCsNFCVd7i+Su0xYsBrIhS3bE2XMv5gNTft2O+PQ=
+github.com/nicksnyder/go-i18n/v2 v2.3.0/go.mod h1:nxYSZE9M0bf3Y70gPQjN9ha7XNHX7gMc814+6wVyEI4=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
+github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
diff --git a/client/i18n.go b/client/i18n.go
new file mode 100755
index 0000000..d90d2aa
--- /dev/null
+++ b/client/i18n.go
@@ -0,0 +1,676 @@
+package main
+
+import (
+	"embed"
+
+	"github.com/BurntSushi/toml"
+	"github.com/cloudfoundry/jibber_jabber"
+	"github.com/nicksnyder/go-i18n/v2/i18n"
+	"golang.org/x/text/language"
+)
+
+type I18nText struct {
+	scan10,scan11,scan12,scan13,scan14,scan15,scan16,scan17,scan18,scan19,scan20,scan21,scan22,scan23,scan24,scan25,scan26,scan27,scan28,scan29,scan30,scan31,scan32,scan33,scan34,scan35,scan36,scan37,scan38,scan39,scan40,scan41,scan42,scan43,scan44,scan45,scan46,scan47,scan48,scan49,scan50,scan51,scan52,scan53,scan54,scan55,scan56,scan57,scan58,scan59,scan60,scan61,scan62,scan63,scan64,scan65,scan66,scan67,scan68,scan69,scan7,scan70,scan72,scan73,scan74,scan75,scan76,scan77,scan78,scan79,scan8,scan80,scan81,scan82,scan83,scan84,scan85,scan86,scan87,scan88,scan89,scan9,scan90,scan91,scan92,scan93,scan94,scan95 string
+}
+
+var localizer *i18n.Localizer
+
+//go:embed active.*.toml
+var LocaleFS embed.FS
+
+var i18nText I18nText
+
+func init() {
+	userLanguage, _ := jibber_jabber.DetectLanguage()
+	userTag := language.MustParse(userLanguage)
+	bundle := i18n.NewBundle(language.English)
+	bundle.RegisterUnmarshalFunc("toml", toml.Unmarshal)
+	bundle.LoadMessageFileFS(LocaleFS, "active.zh.toml")
+	tag, _, _ := language.NewMatcher([]language.Tag{
+		language.English,
+		language.Chinese,
+	}).Match(userTag)
+	localizer = i18n.NewLocalizer(bundle, tag.String())
+	//初始化自动收集的待翻译文本
+	
+		i18nText.scan75 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan75",
+				Other: `The local CA is now uninstalled from the system trust store(s)! 👋`,
+			},
+		})
+		
+		i18nText.scan16 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan16",
+				Other: `
+The certificate and key are at "%s" ✅
+
+`,
+			},
+		})
+		
+		i18nText.scan26 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan26",
+				Other: `failed to read the CSR`,
+			},
+		})
+		
+		i18nText.scan72 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan72",
+				Other: `Warning: "certutil" is not available, so the CA can't be automatically uninstalled from %s (if it was ever installed)! ⚠️`,
+			},
+		})
+		
+		i18nText.scan89 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan89",
+				Other: `ERROR: no %s security databases found`,
+			},
+		})
+		
+		i18nText.scan66 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan66",
+				Other: `Warning: "certutil" is not available, so the CA can't be automatically installed in %s! ⚠️`,
+			},
+		})
+		
+		i18nText.scan48 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan48",
+				Other: `The local CA is already installed in the system trust store! 👍`,
+			},
+		})
+		
+		i18nText.scan60 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan60",
+				Other: `ERROR: %q is not a valid hostname, IP, URL or email: %s`,
+			},
+		})
+		
+		i18nText.scan43 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan43",
+				Other: `failed to save CA key`,
+			},
+		})
+		
+		i18nText.scan94 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan94",
+				Other: `add cert`,
+			},
+		})
+		
+		i18nText.scan15 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan15",
+				Other: `failed to save PKCS#12`,
+			},
+		})
+		
+		i18nText.scan50 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan50",
+				Other: `ERROR: you can't set -[un]install and -CAROOT at the same time`,
+			},
+		})
+		
+		i18nText.scan19 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan19",
+				Other: `
+The legacy PKCS#12 encryption password is the often hardcoded default "changeit" ℹ️
+
+`,
+			},
+		})
+		
+		i18nText.scan32 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan32",
+				Other: `failed to read the CA certificate`,
+			},
+		})
+		
+		i18nText.scan84 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan84",
+				Other: `failed to serialize trust settings`,
+			},
+		})
+		
+		i18nText.scan82 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan82",
+				Other: `failed to parse trust settings`,
+			},
+		})
+		
+		i18nText.scan24 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan24",
+				Other: `
+Reminder: X.509 wildcards only go one level deep, so this won't match a.b.%s ℹ️`,
+			},
+		})
+		
+		i18nText.scan45 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan45",
+				Other: `Created a new local CA 💥
+`,
+			},
+		})
+		
+		i18nText.scan13 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan13",
+				Other: `failed to save certificate key`,
+			},
+		})
+		
+		i18nText.scan41 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan41",
+				Other: `failed to generate CA certificate`,
+			},
+		})
+		
+		i18nText.scan79 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan79",
+				Other: `Warning: "sudo" is not available, and mkcert is not running as root. The (un)install operation might fail. ⚠️`,
+			},
+		})
+		
+		i18nText.scan55 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan55",
+				Other: `failed to create the CAROOT`,
+			},
+		})
+		
+		i18nText.scan58 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan58",
+				Other: `Note: the local CA is not installed in the Java trust store.`,
+			},
+		})
+		
+		i18nText.scan42 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan42",
+				Other: `failed to encode CA key`,
+			},
+		})
+		
+		i18nText.scan81 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan81",
+				Other: `failed to read trust settings`,
+			},
+		})
+		
+		i18nText.scan54 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan54",
+				Other: `ERROR: failed to find the default CA location, set one as the CAROOT env var`,
+			},
+		})
+		
+		i18nText.scan46 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan46",
+				Other: `Exported to the current directory`,
+			},
+		})
+		
+		i18nText.scan18 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan18",
+				Other: `
+The PKCS#12 bundle is at "%s" ✅
+`,
+			},
+		})
+		
+		i18nText.scan21 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan21",
+				Other: `
+Created a new certificate valid for the following names 📜`,
+			},
+		})
+		
+		i18nText.scan88 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan88",
+				Other: `failed to read root certificate`,
+			},
+		})
+		
+		i18nText.scan9 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan9",
+				Other: `failed to generate certificate`,
+			},
+		})
+		
+		i18nText.scan38 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan38",
+				Other: `failed to generate the CA key`,
+			},
+		})
+		
+		i18nText.scan61 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan61",
+				Other: `ERROR: %q is not a valid hostname, IP, URL or email`,
+			},
+		})
+		
+		i18nText.scan62 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan62",
+				Other: `The local CA is now installed in the system trust store! ⚡️`,
+			},
+		})
+		
+		i18nText.scan73 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan73",
+				Other: `You can install "certutil" with "%s" and re-run "mkcert -uninstall" 👈`,
+			},
+		})
+		
+		i18nText.scan7 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan7",
+				Other: `ERROR: can't create new certificates because the CA key (rootCA-key.pem) is missing`,
+			},
+		})
+		
+		i18nText.scan85 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan85",
+				Other: `failed to write trust settings`,
+			},
+		})
+		
+		i18nText.scan93 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan93",
+				Other: `open root store`,
+			},
+		})
+		
+		i18nText.scan29 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan29",
+				Other: `invalid CSR signature`,
+			},
+		})
+		
+		i18nText.scan35 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan35",
+				Other: `failed to read the CA key`,
+			},
+		})
+		
+		i18nText.scan49 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan49",
+				Other: `Root certificate client generated automkcert-root 💥
+`,
+			},
+		})
+		
+		i18nText.scan44 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan44",
+				Other: `failed to save CA certificate`,
+			},
+		})
+		
+		i18nText.scan76 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan76",
+				Other: `The local CA is now uninstalled from the %s trust store(s)! 👋`,
+			},
+		})
+		
+		i18nText.scan11 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan11",
+				Other: `failed to save certificate and key`,
+			},
+		})
+		
+		i18nText.scan39 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan39",
+				Other: `failed to encode public key`,
+			},
+		})
+		
+		i18nText.scan40 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan40",
+				Other: `failed to decode public key`,
+			},
+		})
+		
+		i18nText.scan68 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan68",
+				Other: `The local CA is already installed in Java's trust store! 👍`,
+			},
+		})
+		
+		i18nText.scan90 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan90",
+				Other: `Installing in %s failed. Please report the issue with details about your environment at https://github.com/FiloSottile/mkcert/issues/new 👎`,
+			},
+		})
+		
+		i18nText.scan69 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan69",
+				Other: `The local CA is now installed in Java's trust store! ☕️`,
+			},
+		})
+		
+		i18nText.scan63 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan63",
+				Other: `The local CA is already installed in the %s trust store! 👍`,
+			},
+		})
+		
+		i18nText.scan87 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan87",
+				Other: `You can also manually install the root certificate at %q.`,
+			},
+		})
+		
+		i18nText.scan74 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan74",
+				Other: `Warning: "keytool" is not available, so the CA can't be automatically uninstalled from Java's trust store (if it was ever installed)! ⚠️`,
+			},
+		})
+		
+		i18nText.scan33 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan33",
+				Other: `ERROR: failed to read the CA certificate: unexpected content`,
+			},
+		})
+		
+		i18nText.scan34 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan34",
+				Other: `failed to parse the CA certificate`,
+			},
+		})
+		
+		i18nText.scan95 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan95",
+				Other: "delete cert",
+			},
+		})
+		
+		i18nText.scan52 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan52",
+				Other: `ERROR: can only combine -csr with -install and -cert-file`,
+			},
+		})
+		
+		i18nText.scan59 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan59",
+				Other: `Run "mkcert -install" for certificates to be trusted automatically ⚠️`,
+			},
+		})
+		
+		i18nText.scan78 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan78",
+				Other: `ERROR: failed to execute "%s": %s
+
+%s
+`,
+			},
+		})
+		
+		i18nText.scan80 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan80",
+				Other: `failed to create temp file`,
+			},
+		})
+		
+		i18nText.scan17 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan17",
+				Other: `
+The certificate is at "%s" and the key at "%s" ✅
+
+`,
+			},
+		})
+		
+		i18nText.scan20 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan20",
+				Other: `It will expire on %s 🗓
+
+`,
+			},
+		})
+		
+		i18nText.scan31 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan31",
+				Other: `
+The certificate is at "%s" ✅
+
+`,
+			},
+		})
+		
+		i18nText.scan86 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan86",
+				Other: `Installing to the system store is not yet supported on this Linux 😣 but %s will still work.`,
+			},
+		})
+		
+		i18nText.scan12 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan12",
+				Other: `failed to save certificate`,
+			},
+		})
+		
+		i18nText.scan36 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan36",
+				Other: `ERROR: failed to read the CA key: unexpected content`,
+			},
+		})
+		
+		i18nText.scan8 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan8",
+				Other: `failed to generate certificate key`,
+			},
+		})
+		
+		i18nText.scan25 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan25",
+				Other: `failed to generate serial number`,
+			},
+		})
+		
+		i18nText.scan30 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan30",
+				Other: `failed to parse generated certificate`,
+			},
+		})
+		
+		i18nText.scan37 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan37",
+				Other: `failed to parse the CA key`,
+			},
+		})
+		
+		i18nText.scan56 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan56",
+				Other: `Note: the local CA is not installed in the system trust store.`,
+			},
+		})
+		
+		i18nText.scan51 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan51",
+				Other: `ERROR: you can't set -install and -uninstall at the same time`,
+			},
+		})
+		
+		i18nText.scan28 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan28",
+				Other: `failed to parse the CSR`,
+			},
+		})
+		
+		i18nText.scan10 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan10",
+				Other: `failed to encode certificate key`,
+			},
+		})
+		
+		i18nText.scan65 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan65",
+				Other: `Note: %s support is not available on your platform. ℹ️`,
+			},
+		})
+		
+		i18nText.scan53 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan53",
+				Other: `ERROR: can't specify extra arguments when using -csr`,
+			},
+		})
+		
+		i18nText.scan83 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan83",
+				Other: `ERROR: unsupported trust settings version:`,
+			},
+		})
+		
+		i18nText.scan27 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan27",
+				Other: `ERROR: failed to read the CSR: unexpected content`,
+			},
+		})
+		
+		i18nText.scan57 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan57",
+				Other: `Note: the local CA is not installed in the %s trust store.`,
+			},
+		})
+		
+		i18nText.scan64 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan64",
+				Other: `The local CA is now installed in the %s trust store (requires browser restart)! 🦊`,
+			},
+		})
+		
+		i18nText.scan23 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan23",
+				Other: `   Warning: many browsers don't support second-level wildcards like %q ⚠️`,
+			},
+		})
+		
+		i18nText.scan47 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan47",
+				Other: `The credit client has been generated and is currently in the dist directory. Please deploy it on your server.`,
+			},
+		})
+		
+		i18nText.scan22 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan22",
+				Other: ` - %q`,
+			},
+		})
+		
+		i18nText.scan70 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan70",
+				Other: `Warning: "keytool" is not available, so the CA can't be automatically installed in Java's trust store! ⚠️`,
+			},
+		})
+		
+		i18nText.scan67 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan67",
+				Other: `Install "certutil" with "%s" and re-run "mkcert -install" 👈`,
+			},
+		})
+		
+		i18nText.scan14 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan14",
+				Other: `failed to generate PKCS#12`,
+			},
+		})
+		
+		i18nText.scan91 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan91",
+				Other: `Note that if you never started %s, you need to do that at least once.`,
+			},
+		})
+		
+		i18nText.scan92 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan92",
+				Other: `decode pem`,
+			},
+		})
+		
+		i18nText.scan77 = localizer.MustLocalize(&i18n.LocalizeConfig{
+			DefaultMessage: &i18n.Message{
+				ID:    "scan77",
+				Other: `ERROR: %s: %s`,
+			},
+		})
+		
+}
+	
\ No newline at end of file
diff --git a/client/truststore_darwin.go b/client/truststore_darwin.go
index 83b8fac..9ff5157 100644
--- a/client/truststore_darwin.go
+++ b/client/truststore_darwin.go
@@ -16,9 +16,9 @@ import (
 )
 
 var (
-	FirefoxProfiles     = []string{os.Getenv("HOME") + "/Library/Application Support/Firefox/Profiles/*"}
-	CertutilInstallHelp = "brew install nss"
-	NSSBrowsers         = "Firefox"
+	FirefoxProfiles		= []string{os.Getenv("HOME") + "/Library/Application Support/Firefox/Profiles/*"}
+	CertutilInstallHelp	= "brew install nss"
+	NSSBrowsers		= "Firefox"
 )
 
 // https://github.com/golang/go/issues/24652#issuecomment-399826583
@@ -58,7 +58,8 @@ func (m *mkcert) installPlatform() bool {
 	// https://github.com/golang/go/issues/24652
 
 	plistFile, err := ioutil.TempFile("", "trust-settings")
-	fatalIfErr(err, "failed to create temp file")
+	fatalIfErr(err, i18nText.scan95,
+	)
 	defer os.Remove(plistFile.Name())
 
 	cmd = commandWithSudo("security", "trust-settings-export", "-d", plistFile.Name())
@@ -66,15 +67,19 @@ func (m *mkcert) installPlatform() bool {
 	fatalIfCmdErr(err, "security trust-settings-export", out)
 
 	plistData, err := ioutil.ReadFile(plistFile.Name())
-	fatalIfErr(err, "failed to read trust settings")
+	fatalIfErr(err, i18nText.scan95,
+	)
 	var plistRoot map[string]interface{}
 	_, err = plist.Unmarshal(plistData, &plistRoot)
-	fatalIfErr(err, "failed to parse trust settings")
+	fatalIfErr(err, i18nText.scan95,
+	)
 
 	rootSubjectASN1, _ := asn1.Marshal(m.caCert.Subject.ToRDNSequence())
 
 	if plistRoot["trustVersion"].(uint64) != 1 {
-		log.Fatalln("ERROR: unsupported trust settings version:", plistRoot["trustVersion"])
+		log.Fatalln(i18nText.scan95,
+
+			plistRoot["trustVersion"])
 	}
 	trustList := plistRoot["trustList"].(map[string]interface{})
 	for key := range trustList {
@@ -91,9 +96,11 @@ func (m *mkcert) installPlatform() bool {
 	}
 
 	plistData, err = plist.MarshalIndent(plistRoot, plist.XMLFormat, "\t")
-	fatalIfErr(err, "failed to serialize trust settings")
+	fatalIfErr(err, i18nText.scan95,
+	)
 	err = ioutil.WriteFile(plistFile.Name(), plistData, 0600)
-	fatalIfErr(err, "failed to write trust settings")
+	fatalIfErr(err, i18nText.scan95,
+	)
 
 	cmd = commandWithSudo("security", "trust-settings-import", "-d", plistFile.Name())
 	out, err = cmd.CombinedOutput()
diff --git a/client/truststore_java.go b/client/truststore_java.go
index 8ad84bb..d0074e8 100644
--- a/client/truststore_java.go
+++ b/client/truststore_java.go
@@ -19,13 +19,13 @@ import (
 )
 
 var (
-	hasJava    bool
-	hasKeytool bool
+	hasJava		bool
+	hasKeytool	bool
 
-	javaHome    string
-	cacertsPath string
-	keytoolPath string
-	storePass   string = "changeit"
+	javaHome	string
+	cacertsPath	string
+	keytoolPath	string
+	storePass	string	= "changeit"
 )
 
 func init() {
@@ -100,7 +100,7 @@ func (m *mkcert) uninstallJava() {
 	}
 	out, err := execKeytool(exec.Command(keytoolPath, args...))
 	if bytes.Contains(out, []byte("does not exist")) {
-		return // cert didn't exist
+		return	// cert didn't exist
 	}
 	fatalIfCmdErr(err, "keytool -delete", out)
 }
diff --git a/client/truststore_linux.go b/client/truststore_linux.go
index 2c4e5a3..bab4bda 100644
--- a/client/truststore_linux.go
+++ b/client/truststore_linux.go
@@ -15,13 +15,13 @@ import (
 )
 
 var (
-	FirefoxProfiles = []string{os.Getenv("HOME") + "/.mozilla/firefox/*",
+	FirefoxProfiles	= []string{os.Getenv("HOME") + "/.mozilla/firefox/*",
 		os.Getenv("HOME") + "/snap/firefox/common/.mozilla/firefox/*"}
-	NSSBrowsers = "Firefox and/or Chrome/Chromium"
+	NSSBrowsers	= "Firefox and/or Chrome/Chromium"
 
-	SystemTrustFilename string
-	SystemTrustCommand  []string
-	CertutilInstallHelp string
+	SystemTrustFilename	string
+	SystemTrustCommand	[]string
+	CertutilInstallHelp	string
 )
 
 func init() {
@@ -54,13 +54,18 @@ func (m *mkcert) systemTrustFilename() string {
 
 func (m *mkcert) installPlatform() bool {
 	if SystemTrustCommand == nil {
-		log.Printf("Installing to the system store is not yet supported on this Linux 😣 but %s will still work.", NSSBrowsers)
-		log.Printf("You can also manually install the root certificate at %q.", filepath.Join(m.CAROOT, rootName))
+		log.Printf(i18nText.scan95,
+
+			NSSBrowsers)
+		log.Printf(i18nText.scan95,
+
+			filepath.Join(m.CAROOT, rootName))
 		return false
 	}
 
 	cert, err := ioutil.ReadFile(filepath.Join(m.CAROOT, rootName))
-	fatalIfErr(err, "failed to read root certificate")
+	fatalIfErr(err, i18nText.scan95,
+	)
 
 	cmd := commandWithSudo("tee", m.systemTrustFilename())
 	cmd.Stdin = bytes.NewReader(cert)
diff --git a/client/truststore_nss.go b/client/truststore_nss.go
index ad8d662..eeda4dc 100644
--- a/client/truststore_nss.go
+++ b/client/truststore_nss.go
@@ -15,15 +15,15 @@ import (
 )
 
 var (
-	hasNSS       bool
-	hasCertutil  bool
-	certutilPath string
-	nssDBs       = []string{
+	hasNSS		bool
+	hasCertutil	bool
+	certutilPath	string
+	nssDBs		= []string{
 		filepath.Join(os.Getenv("HOME"), ".pki/nssdb"),
-		filepath.Join(os.Getenv("HOME"), "snap/chromium/current/.pki/nssdb"), // Snapcraft
-		"/etc/pki/nssdb", // CentOS 7
+		filepath.Join(os.Getenv("HOME"), "snap/chromium/current/.pki/nssdb"),	// Snapcraft
+		"/etc/pki/nssdb",	// CentOS 7
 	}
-	firefoxPaths = []string{
+	firefoxPaths	= []string{
 		"/usr/bin/firefox",
 		"/usr/bin/firefox-nightly",
 		"/usr/bin/firefox-developer-edition",
@@ -92,12 +92,18 @@ func (m *mkcert) installNSS() bool {
 		out, err := execCertutil(cmd)
 		fatalIfCmdErr(err, "certutil -A -d "+profile, out)
 	}) == 0 {
-		log.Printf("ERROR: no %s security databases found", NSSBrowsers)
+		log.Printf(i18nText.scan95,
+
+			NSSBrowsers)
 		return false
 	}
 	if !m.checkNSS() {
-		log.Printf("Installing in %s failed. Please report the issue with details about your environment at https://github.com/FiloSottile/mkcert/issues/new 👎", NSSBrowsers)
-		log.Printf("Note that if you never started %s, you need to do that at least once.", NSSBrowsers)
+		log.Printf(i18nText.scan95,
+
+			NSSBrowsers)
+		log.Printf(i18nText.scan95,
+
+			NSSBrowsers)
 		return false
 	}
 	return true
diff --git a/client/truststore_windows.go b/client/truststore_windows.go
index a4c9fcb..5c9806b 100644
--- a/client/truststore_windows.go
+++ b/client/truststore_windows.go
@@ -17,37 +17,41 @@ import (
 )
 
 var (
-	FirefoxProfiles     = []string{os.Getenv("USERPROFILE") + "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"}
-	CertutilInstallHelp = "" // certutil unsupported on Windows
-	NSSBrowsers         = "Firefox"
+	FirefoxProfiles		= []string{os.Getenv("USERPROFILE") + "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"}
+	CertutilInstallHelp	= ""	// certutil unsupported on Windows
+	NSSBrowsers		= "Firefox"
 )
 
 var (
-	modcrypt32                           = syscall.NewLazyDLL("crypt32.dll")
-	procCertAddEncodedCertificateToStore = modcrypt32.NewProc("CertAddEncodedCertificateToStore")
-	procCertCloseStore                   = modcrypt32.NewProc("CertCloseStore")
-	procCertDeleteCertificateFromStore   = modcrypt32.NewProc("CertDeleteCertificateFromStore")
-	procCertDuplicateCertificateContext  = modcrypt32.NewProc("CertDuplicateCertificateContext")
-	procCertEnumCertificatesInStore      = modcrypt32.NewProc("CertEnumCertificatesInStore")
-	procCertOpenSystemStoreW             = modcrypt32.NewProc("CertOpenSystemStoreW")
+	modcrypt32				= syscall.NewLazyDLL("crypt32.dll")
+	procCertAddEncodedCertificateToStore	= modcrypt32.NewProc("CertAddEncodedCertificateToStore")
+	procCertCloseStore			= modcrypt32.NewProc("CertCloseStore")
+	procCertDeleteCertificateFromStore	= modcrypt32.NewProc("CertDeleteCertificateFromStore")
+	procCertDuplicateCertificateContext	= modcrypt32.NewProc("CertDuplicateCertificateContext")
+	procCertEnumCertificatesInStore		= modcrypt32.NewProc("CertEnumCertificatesInStore")
+	procCertOpenSystemStoreW		= modcrypt32.NewProc("CertOpenSystemStoreW")
 )
 
 func (m *mkcert) installPlatform() bool {
 	// Load cert
 	cert, err := ioutil.ReadFile(filepath.Join(m.CAROOT, rootName))
-	fatalIfErr(err, "failed to read root certificate")
+	fatalIfErr(err, i18nText.scan95,
+	)
 	// Decode PEM
 	if certBlock, _ := pem.Decode(cert); certBlock == nil || certBlock.Type != "CERTIFICATE" {
-		fatalIfErr(fmt.Errorf("invalid PEM data"), "decode pem")
+		fatalIfErr(fmt.Errorf("invalid PEM data"), i18nText.scan95,
+		)
 	} else {
 		cert = certBlock.Bytes
 	}
 	// Open root store
 	store, err := openWindowsRootStore()
-	fatalIfErr(err, "open root store")
+	fatalIfErr(err, i18nText.scan95,
+	)
 	defer store.close()
 	// Add cert
-	fatalIfErr(store.addCert(cert), "add cert")
+	fatalIfErr(store.addCert(cert), i18nText.scan95,
+	)
 	return true
 }
 
@@ -55,14 +59,16 @@ func (m *mkcert) uninstallPlatform() bool {
 	// We'll just remove all certs with the same serial number
 	// Open root store
 	store, err := openWindowsRootStore()
-	fatalIfErr(err, "open root store")
+	fatalIfErr(err, i18nText.scan95,
+	)
 	defer store.close()
 	// Do the deletion
 	deletedAny, err := store.deleteCertsWithSerial(m.caCert.SerialNumber)
 	if err == nil && !deletedAny {
 		err = fmt.Errorf("no certs found")
 	}
-	fatalIfErr(err, "delete cert")
+	fatalIfErr(err, i18nText.scan95,
+	)
 	return true
 }
 
@@ -91,12 +97,12 @@ func (w windowsRootStore) close() error {
 func (w windowsRootStore) addCert(cert []byte) error {
 	// TODO: ok to always overwrite?
 	ret, _, err := procCertAddEncodedCertificateToStore.Call(
-		uintptr(w), // HCERTSTORE hCertStore
-		uintptr(syscall.X509_ASN_ENCODING|syscall.PKCS_7_ASN_ENCODING), // DWORD dwCertEncodingType
-		uintptr(unsafe.Pointer(&cert[0])),                              // const BYTE *pbCertEncoded
-		uintptr(len(cert)),                                             // DWORD cbCertEncoded
-		3,                                                              // DWORD dwAddDisposition (CERT_STORE_ADD_REPLACE_EXISTING is 3)
-		0,                                                              // PCCERT_CONTEXT *ppCertContext
+		uintptr(w),	// HCERTSTORE hCertStore
+		uintptr(syscall.X509_ASN_ENCODING|syscall.PKCS_7_ASN_ENCODING),	// DWORD dwCertEncodingType
+		uintptr(unsafe.Pointer(&cert[0])),				// const BYTE *pbCertEncoded
+		uintptr(len(cert)),						// DWORD cbCertEncoded
+		3,								// DWORD dwAddDisposition (CERT_STORE_ADD_REPLACE_EXISTING is 3)
+		0,								// PCCERT_CONTEXT *ppCertContext
 	)
 	if ret != 0 {
 		return nil
diff --git a/i18ntools/i18nTools.go b/i18ntools/i18nTools.go
index a43f46e..0f944ce 100644
--- a/i18ntools/i18nTools.go
+++ b/i18ntools/i18nTools.go
@@ -40,8 +40,8 @@ func init() {
 
 }
 func execute() error {
-	paths := []string{"../"}
-	dist := "../"
+	paths := []string{"../client/"}
+	dist := "../client/"
 	for _, path := range paths {
 		if err := filepath.Walk(path, func(path string, info os.FileInfo, err error) error {
 			if err != nil {
@@ -166,7 +166,7 @@ func initMessageMap() map[string]string {
 
 		vs, ok1 := v.(string)
 		if ok1 {
-			mapres[k] = vs
+			mapres[k] = "`" + vs + "`"
 		}
 	}