Skip to content
All tools

Self-Signed Certificate Generator

Create a certificate and private key for a dev box, a lab VM or an appliance that cannot get a public certificate, with the names and settings browsers actually require.

The hostname or IP address clients will connect to. It is added to the SANs automatically.

Browsers only match the SAN list, never the common name, so list every hostname and IP address the service answers on.

P-256 is small, fast and accepted everywhere modern. Pick RSA for old appliances or software that cannot load EC keys.

365 is a sensible default. Apple clients refuse server certificates valid for more than 825 days.

What the certificate contains

A version 3 X.509 certificate with a random serial number, your common name and optional organization as subject and issuer, the validity period you chose, and the extensions modern clients expect: a Subject Alternative Name list with every hostname and IP address you entered, key usage, extended key usage for server and client authentication, and a subject key identifier. RSA certificates are signed with SHA-256; ECDSA certificates with SHA-256 or SHA-384 to match the curve.

Installing it

Give the certificate and key to the server as you would any other pair: a .crt and .key for NGINX, Apache or HAProxy, or combine them into a PFX with the format converter for IIS and Windows services. Then import the certificate into the trusted store on each client, or into the trusted root store if you generated a CA. Chrome and Edge on Windows use the Windows store; Firefox has its own unless configured otherwise.

Limits worth knowing

  • Apple devices reject TLS server certificates valid for more than 825 days, even self-signed ones you have trusted manually.
  • Some older software cannot load ECDSA keys. If a device refuses the key, regenerate with RSA 2048.
  • Self-signed certificates have no revocation story. If the key leaks, replace the certificate everywhere and remove the old one from every trust store.

Frequently asked questions

Runs entirely in your browser. Certificates, keys and passwords you enter here are processed locally with JavaScript and are never uploaded or sent to any server — nothing is stored, logged or transmitted.