What this self-signed certificate generator makes
A self-signed certificate is signed by its own key instead of a certificate authority. This self-signed certificate generator creates a new RSA key pair and a certificate in which the issuer and subject are the same, with the Subject Alternative Names you list. It is the quickest way to run HTTPS on localhost, a Docker container, a Raspberry Pi or an internal dashboard.
When a self-signed certificate is the right choice
Self-signed certificates encrypt traffic just like CA-issued ones, but no browser trusts them by default. They suit development machines, automated tests, service-to-service links where you control both ends, and lab equipment. For a public website, use a certificate from a public CA and create the request with the CSR generator.
Example
With the defaults (CN localhost, SANs 127.0.0.1, ::1, dev.local, 365 days), the generated certificate decodes to:
Subject: CN=localhost
Issuer: CN=localhost (self-signed)
Status: valid (364 days left)
Signature: sha256WithRSAEncryption
Public key: RSA 2048 bit, e=65537
Names (SAN): DNS:localhost, IP:127.0.0.1, IP:0000:0000:0000:0000:0000:0000:0000:0001, DNS:dev.local
Extensions:
basicConstraints (critical): {"CA":false}
keyUsage (critical): digitalSignature, keyEncipherment
extKeyUsage: serverAuth (TLS Web Server Authentication), clientAuth (TLS Web Client Authentication)Paste your own result into the SSL certificate decoder to confirm the names and dates before you deploy it.
Options explained
- Common Name: stored as the subject and issuer CN and added as the first SAN.
- Extra SANs: IPv4 and IPv6 addresses become IP entries and everything else becomes a DNS name. Browsers match only these names, so list every hostname and IP you will type into the address bar.
- Valid for (days): 1 to 10,950 days. The start time is set one minute in the past to allow for small clock differences. Apple platforms reject TLS server certificates valid for more than 825 days, so the default of 365 is a safe choice.
- RSA key size: 2048, 3072 or 4096 bits. The certificate is signed with SHA-256.
- Make it a CA certificate: sets basicConstraints CA:true and key usage keyCertSign and cRLSign, and leaves out the server and client auth usages. Use it as a private root, then sign server certificates with openssl.
Using the certificate
Save the two blocks as localhost.crt and localhost.key. In nginx, point ssl_certificate and ssl_certificate_key at them. In Node.js, pass both files to https.createServer({ key, cert }). To stop browser warnings, import the .crt into your operating system or browser trust store as a trusted certificate. Only do this for certificates you generated yourself.
Common errors and fixes
- NET::ERR_CERT_COMMON_NAME_INVALID: the host in the address bar is not in the SAN list. Add it and generate again.
- Still untrusted after importing: make sure you imported the certificate into the trusted root store, not the personal store, and restart the browser.
- Key and certificate mismatch: every run creates a new key. Always keep the key and certificate from the same run together.
Privacy
The RSA key pair is generated with WebCrypto and the certificate is signed with node-forge, both in your browser. Neither the key nor the certificate is sent to a server. For JWT or SSH keys rather than TLS certificates, see the RSA key generator.