JSONToTable
Loading Self-Signed Certificate Generator...
Please wait a moment

How to Generate Self-Signed Certificates - Step by Step Guide

Step 1

Enter Certificate Information

Fill in your certificate details. For testing and development, you can use localhost or test domain names. The Common Name (CN) is required:

•
Common Name (CN): Your domain or localhost (e.g., localhost, test.local, *.example.dev)
•
Organization details: Optional fields for organization, department, location
•
Subject Alternative Names: Additional domains covered by the certificate
•
Try the sample: Click "Sample" to load example data and see how it works

Example: Development Certificate

Common Name: localhost
Organization: Development Team
SANs: localhost, 127.0.0.1, *.local
Validity: 365 days
Step 2

Configure Key Type and Validity

Choose your cryptographic key type and set the certificate validity period. The tool supports both RSA and ECDSA keys:

•
RSA Keys: Choose 2048-bit (standard) or 4096-bit (extra security)
•
ECDSA Keys: Modern elliptic curve cryptography (P-256, P-384, P-521)
•
Validity Period: Set how long the certificate should be valid (1-36500 days)

Recommended Settings for Development

Key Type: RSA 2048-bit (fast generation, widely supported)
Validity: 365 days (1 year - good for development)
Alternative: ECDSA P-256 (smaller, faster, modern)
Step 3

Generate Certificate and Keys

Click "Generate Certificate" to create your self-signed certificate with private and public keys instantly using the Web Crypto API:

•
Instant generation: Certificate and keys created in seconds
•
Client-side security: Everything generated in your browser, nothing sent to servers
•
Three files: Certificate (.crt), Private Key (.pem), and Public Key (.pem)

Example: Generated Certificate

Your certificate will be in X.509 format with PEM encoding:

-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAKL0UG+mRkmWMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
aWRnaXRzIFB0eSBMdGQwHhcNMjYwMTMxMDAwMDAwWhcNMjcwMTMxMDAwMDAwWjBF
...
-----END CERTIFICATE-----
Step 4

Install Certificate on Your Server

Download and install the generated certificate and private key on your development server or application:

•
Node.js: Use certificate and key in HTTPS server options
•
Apache: Configure SSLCertificateFile and SSLCertificateKeyFile
•
Nginx: Set ssl_certificate and ssl_certificate_key directives
•
Docker: Mount certificate and key files as volumes

Example: Node.js HTTPS Server

Simple setup for local development:

const https = require('https');
const fs = require('fs');

const options = {
  key: fs.readFileSync('private-key.pem'),
  cert: fs.readFileSync('certificate.crt')
};

https.createServer(options, (req, res) => {
  res.writeHead(200);
  res.end('Secure HTTPS Server');
}).listen(443);

Frequently Asked Questions

What is a self-signed certificate?

A self-signed certificate is an SSL/TLS certificate that is signed by the entity that created it, rather than by a trusted Certificate Authority (CA). It's perfect for testing, development, and internal applications where browser trust warnings are acceptable.

Can I use self-signed certificates in production?

Self-signed certificates should not be used in production for public-facing websites as browsers will show security warnings to users. For production, use certificates from trusted CAs like Let's Encrypt or DigiCert. They're suitable for internal applications where you can distribute the certificate to trusted users.

Is it safe to generate certificates online?

Yes! This generator runs entirely in your browser using the Web Crypto API. Your private key never leaves your computer and is not sent to any server. However, always download and secure your private key immediately after generation following NIST key management guidelines.

How do I trust a self-signed certificate?

To avoid browser warnings, you can add the certificate to your system's trusted root store. On Windows, use certmgr.msc; on macOS, use Keychain Access; on Linux, copy to /usr/local/share/ca-certificates/ and run update-ca-certificates. For development, most browsers also have options to proceed past the warning.

Should I use RSA or ECDSA keys?

Both are secure. RSA is more widely supported and traditional. ECDSA offers equivalent security with smaller key sizes and better performance. For development, RSA 2048-bit is the standard choice. For modern applications with good browser support, ECDSA P-256 is faster and more efficient.

What is the validity period for development certificates?

For development, 365 days (1 year) is a good default. You can generate certificates valid for 1-100 years, but remember you'll need to regenerate when it expires. Production certificates from CAs typically have shorter validity periods (90 days for Let's Encrypt, 1-2 years for commercial CAs).

Can I use wildcards in self-signed certificates?

Yes! You can use wildcard domains like *.example.dev or *.local in the Common Name or Subject Alternative Names. This allows one certificate to cover multiple subdomains. Perfect for development environments with multiple services on different subdomains.

How do I use this certificate with Docker?

Mount the certificate and key files as volumes in your Docker container and configure your application to use them. Example: `docker run -v ./certificate.crt:/app/cert.crt -v ./private-key.pem:/app/key.pem your-image`. Make sure file permissions are set correctly (readable by the application user).

Related Tools

SSL Checker

Check SSL certificates on live websites - view validity, expiration dates, issuer details, and security status instantly

SSL Certificate Converter

Convert SSL certificates between formats: PEM (text), DER (hex), CRT (PEM file), CER (DER file) with auto-detection

SSL Certificate Decoder

Parse and view SSL/TLS certificate details including subject, issuer, validity, public key, extensions, and fingerprints

CSR Decoder

Decode and verify Certificate Signing Requests (CSR) to view subject, public key, and signature details before submission

CSR Generator

Generate Certificate Signing Requests (CSR) with private and public keys for SSL/TLS certificates using RSA or ECDSA

SSL Certificate Chain Validator

Validate SSL certificate chains, verify certificate order, and check trust paths