Self-Signed Certificate Generator

About Self-Signed Certificate Generator

HTTPS on a development machine needs a certificate, and a public CA will not issue one for localhost or a private name. This makes one in the browser: the key pair comes from Web Crypto, the certificate is built and signed here, and the private key never leaves the tab.

The details that decide whether a browser accepts it are handled for you. Every name goes into the Subject Alternative Name extension, because browsers ignore the common name and have for years. Key usage and extended key usage are set for a TLS server. The serial is random, the start time is back-dated a minute for clocks that run slow, and the validity is checked against the 825-day limit Apple platforms enforce.

For a team, make a certificate authority instead: trust it once on each machine, then sign each server's CSR with it. That is how tools like mkcert work, and it avoids trusting a separate certificate for every project.

Where it helps

• Generates the key and signs the certificate in the browser; the private key is never sent anywhere.
• Writes the extensions browsers actually check: subject alternative names, key usage, extended key usage and basic constraints.
• Warns about validity longer than Apple platforms accept, and about wildcard rules that surprise people.
• Makes either a server certificate or a CA, with the certificate and key offered as separate files.

Limits

• A self-signed certificate is only trusted where you install it. It is for development and internal testing, never for a public site.
• It cannot yet sign a CSR with a CA made here. Use openssl x509 -req with the CA's files, which the OpenSSL helper writes for you.
• IPv6 addresses are not accepted as alternative names.

Frequently asked questions

Why does my browser still warn about the certificate?

Because nothing vouches for it until you trust it. Add the .crt to the operating system's trust store — Keychain Access on macOS, certmgr on Windows, update-ca-certificates on Debian and Ubuntu — or to Firefox's own store, which it keeps separately. Then restart the browser.

Should I set the common name or the alternative names?

Both, but the alternative names are what count. Browsers have ignored the common name for matching since 2017. This tool always copies the common name into the alternative names as well.

Is ECDSA or RSA better for a development certificate?

ECDSA P-256. Its keys and signatures are much smaller, handshakes are faster, and every current browser, curl, Node and Java supports it. Choose RSA only for a very old client or device that does not.

Related tools

• CSR Generator — Generate a key pair and certificate signing request locally
• Certificate Viewer — Decode a PEM certificate or CSR in the browser
• OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
• Certificate Converter — Convert certificates between PEM, DER and Base64, unpack .p7b bundles, and put a chain in order
• SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
• Certificate Chain Validator — Walk the served chain and flag ordering and trust problems

More SSL & Certificates tools

• SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
• Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
• Certificate Expiry Checker — Check expiry dates for up to ten hosts at once
• Certificate Viewer — Decode a PEM certificate or CSR in the browser
• OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
• CSR Generator — Generate a key pair and certificate signing request locally
• Certificate Converter — Convert certificates between PEM, DER and Base64, unpack .p7b bundles, and put a chain in order
• Certificate Transparency Search — Every certificate public CAs have issued for a domain, the subdomains they reveal, and what is about to expire