# What Is Self-Signed Certificate? Definition and Examples

> Self-signed certificates are certificates signed with their own private key, so issuer and subject are identical and no CA vouches for them.

Source: https://ssl.sh/glossary/self-signed-certificate/
Last updated: 2026-11-10

A self-signed certificate is created and signed by the same key pair it certifies. Every [root certificate](https://ssl.sh/glossary/root-certificate/) is technically self-signed, but the term usually means a server certificate an administrator made with a tool such as OpenSSL. Clients have no CA to check it against, so they reject it unless that exact certificate has been added to their [trust store](https://ssl.sh/glossary/trust-store/) or accepted as an exception.

## Why it matters
Self-signed certificates give the same encryption strength as CA-issued ones but no authentication: a client cannot tell your certificate from one an attacker generated. Browsers show errors such as MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT or NET::ERR_CERT_AUTHORITY_INVALID, and command-line tools report "self-signed certificate in certificate chain". They remain useful for local development, lab equipment and quick tests. For anything shared across people or machines, a [private CA](https://ssl.sh/glossary/private-ca/) scales better, and public sites can get free trusted certificates through ACME.

## Example
```bash
openssl req -x509 -newkey rsa:2048 -nodes -days 30 \
  -keyout localhost.key -out localhost.crt \
  -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
```

The SAN entry is essential, because browsers ignore the CN.

## Common misconceptions
- **Self-signed means unencrypted or weakly encrypted.** The encryption is identical; what is missing is proof of identity.
- **Clicking through the warning is harmless.** It trains users to ignore warnings, an attacker's certificate produces the same warning, and sites using HSTS do not allow clicking through at all.
- **Self-signed certificates are free, so they suit public sites.** Free CA-issued certificates are widely available; self-signed ones only make sense where you control every client.

## Related terms

- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。
- [私有 CA](https://ssl.sh/zh/glossary/private-ca/): 私有 CA 是企业为自己的系统和设备搭建的证书颁发机构，其根证书只在企业主动安装的设备上受信任。
- [信任库](https://ssl.sh/zh/glossary/trust-store/): 信任库是操作系统、浏览器或编程语言运行时内置的一组根 CA 证书，验证证书链时以它们作为信任锚。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [OpenSSL](https://ssl.sh/zh/glossary/openssl/): OpenSSL 是开源密码学工具包，由 TLS 协议库 libssl、通用密码库 libcrypto 和 openssl 命令行工具组成。
- [基本约束](https://ssl.sh/zh/glossary/basic-constraints/): 基本约束是 X.509 证书扩展，用来声明该证书是否属于 CA，以及其下方还允许出现多少层 CA。