Generate
Self-signed certificate generator
Create a self-signed certificate and private key for development, testing or internal services, without installing anything.
Runs in your browser Private keys are generated and processed in your browser (WebCrypto) and never leave your device. Nothing is uploaded to ssl.sh.
The self-signed certificate generator creates an X.509 certificate and its private key in your browser. Enter a host name, add any other names or IP addresses, choose the key type and validity, and press Generate certificate. You get the certificate, the private key and the equivalent OpenSSL command.
How to use it
- Common Name: the host name, for example
dev.example.comorlocalhost. - SANs: one per line, e.g.
localhost,127.0.0.1,::1. Clients check SANs, not the CN. - Choose the key type and the validity in days (365 by default).
- Optionally tick CA certificate to create a test CA instead of a server certificate.
- Press Generate certificate and download the
.crtand.keyfiles.
Equivalent OpenSSL command (OpenSSL 1.1.1+):
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
-keyout dev.key -out dev.crt -days 365 -subj '/CN=dev.example.com' \
-addext 'subjectAltName=DNS:dev.example.com,DNS:localhost,IP:127.0.0.1' \
-addext basicConstraints=critical,CA:FALSE -addext extendedKeyUsage=serverAuth
What the certificate contains
Server certificates get basicConstraints CA:FALSE, keyUsage digitalSignature (plus keyEncipherment for RSA), extendedKeyUsage serverAuth, the SAN list and a subject key identifier. A random 128-bit serial number is used. CA certificates get CA:TRUE with keyCertSign and cRLSign.
When to use self-signed certificates
- Local development and test environments.
- Internal services where you control every client and can distribute the certificate.
- Lab setups for mutual TLS.
For anything public, use a certificate from a public CA. To convert the result for Windows or Java, use the SSL converter; to inspect it, the certificate decoder.
FAQ
Why does my browser still show a warning?
Nobody vouches for a self-signed certificate, so browsers show NET::ERR_CERT_AUTHORITY_INVALID until you import the certificate (or the test CA that signed it) into the operating system or browser trust store.
Can I use a self-signed certificate on a public website?
You should not. Every visitor sees a security warning. Public sites should use a free certificate from a public CA through ACME, such as Let's Encrypt.
How long should a self-signed certificate be valid?
For local development a year or two is common. Public-CA lifetime limits do not apply to certificates you trust manually, but a shorter lifetime limits the damage if the key leaks. Test CAs are often valid for several years.
What is the CA option for?
It makes a certificate that can sign others. Import that one CA certificate into your test devices once, then issue server certificates from it, instead of trusting each self-signed certificate individually.