SSL Certificate Generator
Create a self-signed certificate and its private key for local development, test servers and internal services. Nothing is stored in our servers.
- Runs in your browser
- Free to use
About this tool
A self-signed certificate is signed with its private key instead of by a certificate authority. It encrypts traffic as well as a paid certificate, but browsers and clients won't trust it until you tell them to. With curl, you can skip certificate verification using the -k flag.
This tool creates an RSA key pair with your browser's built-in Web Crypto API inside a background worker, builds an X.509 v3 certificate and signs it locally. No request is sent to our servers; you can disconnect from the network after the page loads and it still works.
Use it for local development over HTTPS, staging and test servers, intranet dashboards, lab equipment and IoT devices where public trust is not required. For a public website, get a free certificate from a trusted authority such as Let's Encrypt instead.
Check a remote website's deployed certificate with our dedicated tools SSL Certificate Check and the TLS Version Checker.
How to use it — quick steps
- 01
Enter the common name
Type the domain or IP the certificate is for; add extra names or IPs in the SAN field if needed.
- 02
Pick the settings
Choose RSA or ECDSA, the key size or curve, the signature hash, the validity and the organisation.
- 03
Generate and download
The key pair and certificate are created in a worker; copy or download the .crt, .key or the .pem.
Key features of this tool
RSA or ECDSA, real X.509 v3
RSA 2048/4096 or ECDSA P-256/P-384 keys, subject alternative names for domains, wildcards and IPs, key usage, basic constraints, serial and fingerprints, like OpenSSL would produce.
Private key never leaves the browser
Keys are created by the Web Crypto API inside a Web Worker and shown only to you; no data is sent to our servers.
Ready for dev servers
Download the .crt and .key separately or as one .pem for Nginx, Apache, Node, Docker and local HTTPS.
Frequently asked questions
What is a self-signed certificate?
A certificate signed with its own private key instead of by a certificate authority. It encrypts traffic just like a CA-issued one, but browsers and clients warn until you trust it explicitly; for public sites use a free Let's Encrypt certificate instead.
RSA or ECDSA?
RSA 2048 with SHA-256 works everywhere; ECDSA P-256 gives equivalent security with much smaller keys and faster handshakes and is supported by all modern clients. Use P-384 or RSA 4096 when a policy demands it; SHA-1 is only for legacy devices.
Why does my browser still warn?
Self-signed certificates are untrusted by design. Import the .crt into your OS or browser trust store (or your test clients) to silence the warning, and make sure the hostname you visit is in the SAN list.
What is the OpenSSL equivalent?
openssl req -x509 -newkey rsa:2048 -sha256 -days 365 -nodes -keyout example.key -out example.crt -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com"
Are my files or data uploaded?
No. The tool is plain JavaScript that runs in your browser; the files or data you provide here are never uploaded to our servers.