Create a self-signed X.509 certificate and private key for localhost, test servers and internal tools. Add every hostname and IP as a SAN, pick the validity, then download PEM files or a password-protected PFX. Everything is generated on your device.
Last updated:
Names
More subject fields (optional)
Certificate
Certificate type
Certificatepublic
Private keykeep secret
OpenSSL equivalent and server config
Advertisement
Advertisement
How to use the Self-Signed Certificate Generator
Enter the hostnames the certificate should cover. The default localhost, 127.0.0.1 and ::1 suits local development.
Choose the validity in days and the key type. RSA 2048 works everywhere; ECDSA P-256 is smaller and faster.
Press Generate certificate. The certificate and private key appear as PEM text.
Download the .crt and .key files for nginx, Apache or Node.js, or set a password and download the .pfx for Windows, IIS or .NET.
Trust the certificate on your computer (see the instructions below) so browsers stop showing a warning.
Trust the certificate on your computer
A self-signed certificate is only accepted after you add it to a trust store. Use the .crt file (never share the key):
System
How to trust the certificate
macOS
Double-click the .crt to add it to Keychain Access (System keychain), open it, expand Trust and set When using this certificate to Always Trust. Or run sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain localhost.crt
Windows
Double-click the .crt, choose Install Certificate, Local Machine, then Place all certificates in the following store and pick Trusted Root Certification Authorities. PowerShell: Import-Certificate -FilePath localhost.crt -CertStoreLocation Cert:\LocalMachine\Root
Settings, Privacy & Security, View Certificates, Authorities, Import, tick Trust this CA to identify websites. (Or enable security.enterprise_roots.enabled to use the system store.)
Node.js clients
NODE_EXTRA_CA_CERTS=./localhost.crt node app.js
Restart the browser after importing. If Chrome still reports NET::ERR_CERT_COMMON_NAME_INVALID, the hostname in the address bar is missing from the Subject Alternative Names.
X.509 version 3 with a random 128-bit serial number and a start time 5 minutes in the past to tolerate small clock differences.
Subject Alternative Names for every DNS name and IP address you list (browsers require them).
Server / TLS: Basic Constraints CA:FALSE, Key Usage digitalSignature (plus keyEncipherment for RSA) and Extended Key Usage serverAuth and clientAuth.
Root CA: Basic Constraints CA:TRUE and Key Usage keyCertSign, cRLSign, so you can sign other certificates with openssl x509 -req -CA ca.crt -CAkey ca.key ….
Subject and Authority Key Identifiers (SHA-1 of the public key), as OpenSSL adds by default.
Frequently asked questions
What is a self-signed certificate?
It is an X.509 certificate signed with its own private key instead of by a certificate authority. It encrypts traffic just like a CA-issued certificate, but browsers show a warning until you explicitly trust it, because no third party has vouched for it. That makes it ideal for localhost, test environments and internal services, but not for public websites.
Why does the browser still show a warning?
Browsers only trust certificates that chain to a root in their trust store. Import the .crt file into your operating system or browser trust store (instructions below) and restart the browser. Also make sure the hostname you visit is listed in the Subject Alternative Names: Chrome ignores the Common Name.
Should I make a server certificate or a root CA?
For a single dev server a server certificate is simplest: trust it directly. If you have several local sites, create a root CA here, trust it once, then sign per-site certificates with it using OpenSSL. Never share a trusted root CA key: anyone holding it could impersonate any website on your machine.
How long should a self-signed certificate be valid?
For local development one or two years is practical. Apple platforms reject TLS server certificates valid for more than 825 days, so stay under that if you test on macOS or iOS. Public certificate authorities are limited to 398 days, but that rule does not apply to certificates you trust manually.
What password does the PFX file use?
The one you type in the PFX password field. The private key inside the PFX is encrypted with AES-256 (PBES2, PBKDF2-SHA256) and the file is protected with a SHA-256 MAC, the same defaults OpenSSL 3 uses. Windows 10 1709 and later, .NET and Java read it. Very old systems may need: openssl pkcs12 -in cert.pfx -nodes | openssl pkcs12 -export -legacy -out legacy.pfx.
Is it safe to generate a private key in the browser?
The key pair is created by the browser's Web Crypto API with a cryptographically secure random number generator, and nothing is uploaded or stored. For production keys follow your organisation's policy, which may require generating keys on the server or in a hardware module.
Can I use this certificate for a public website?
You can, but every visitor would see a security warning. For public sites use a free certificate authority such as Let's Encrypt, which issues browser-trusted certificates automatically.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.