# Self-Signed Certificate Generator (Browser-Based, with SANs)

> Generate a self-signed TLS certificate and key in your browser: RSA or ECDSA, DNS and IP SANs, custom validity, optional test CA.

Source: https://ssl.sh/tools/self-signed-certificate-generator/
Last updated: 2026-11-10

Create a self-signed certificate and private key for development, testing or internal services, without installing anything.

The self-signed certificate generator creates an X.509 certificate and its private key in your browser. Enter a host name, add any other names or IP addresses, choose the key type and validity, and press **Generate certificate**. You get the certificate, the private key and the equivalent OpenSSL command.

## How to use it

1. **Common Name**: the host name, for example `dev.example.com` or `localhost`.
2. **SANs**: one per line, e.g. `localhost`, `127.0.0.1`, `::1`. Clients check SANs, not the CN.
3. Choose the key type and the validity in days (365 by default).
4. Optionally tick **CA certificate** to create a test CA instead of a server certificate.
5. Press **Generate certificate** and download the `.crt` and `.key` files.

Equivalent OpenSSL command (OpenSSL 1.1.1+):

```bash
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout dev.key -out dev.crt -days 365 -subj '/CN=dev.example.com' \
  -addext 'subjectAltName=DNS:dev.example.com,DNS:localhost,IP:127.0.0.1' \
  -addext basicConstraints=critical,CA:FALSE -addext extendedKeyUsage=serverAuth
```

## What the certificate contains

Server certificates get `basicConstraints CA:FALSE`, `keyUsage digitalSignature` (plus `keyEncipherment` for RSA), `extendedKeyUsage serverAuth`, the SAN list and a subject key identifier. A random 128-bit serial number is used. CA certificates get `CA:TRUE` with `keyCertSign` and `cRLSign`.

## When to use self-signed certificates

- Local development and test environments.
- Internal services where you control every client and can distribute the certificate.
- Lab setups for mutual TLS.

For anything public, use a certificate from a public CA. To convert the result for Windows or Java, use the [SSL converter](https://ssl.sh/tools/ssl-converter/pem-to-pfx/); to inspect it, the [certificate decoder](https://ssl.sh/tools/certificate-decoder/).


## FAQ

**Why does my browser still show a warning?**

Nobody vouches for a self-signed certificate, so browsers show NET::ERR_CERT_AUTHORITY_INVALID until you import the certificate (or the test CA that signed it) into the operating system or browser trust store.

**Can I use a self-signed certificate on a public website?**

You should not. Every visitor sees a security warning. Public sites should use a free certificate from a public CA through ACME, such as Let's Encrypt.

**How long should a self-signed certificate be valid?**

For local development a year or two is common. Public-CA lifetime limits do not apply to certificates you trust manually, but a shorter lifetime limits the damage if the key leaks. Test CAs are often valid for several years.

**What is the CA option for?**

It makes a certificate that can sign others. Import that one CA certificate into your test devices once, then issue server certificates from it, instead of trusting each self-signed certificate individually.