Self-signed certificate generator

A self-signed certificate is a TLS certificate signed by its own private key instead of a trusted certificate authority. Browsers will warn about it because no trusted CA vouches for it, but it encrypts traffic just like a CA-issued certificate. That makes it useful for local development, internal test servers, lab environments and devices that are never exposed publicly.

How to use it

1. Enter the common name and subject alternative names, such as localhost, 127.0.0.1 or myapp.test.
2. Choose the key size and validity period.
3. Generate and download the certificate and private key in PEM format.
4. Configure your web server or dev server to use them.

Using the certificate

• Node.js: https.createServer({ key, cert }, app)
• Nginx: ssl_certificate cert.pem; and ssl_certificate_key key.pem;
• Vite: set server.https with the key and cert files.

OpenSSL equivalent

openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj '/CN=localhost' -addext 'subjectAltName=DNS:localhost,IP:127.0.0.1'

Avoiding browser warnings

• Browsers require the hostname in the SAN list; the CN alone is not enough.
• To remove warnings on your own machine, add the certificate to your operating system's trust store, or use mkcert, which creates a local CA and trusted certificates automatically.
• Many browsers reject certificates valid for longer than about 398 days, even when trusted.

When not to use self-signed certificates

Never use them on public websites. Visitors see security warnings and learn to click through them. Use a free certificate from Let's Encrypt instead.