Self-Signed SSL Certificate Generator
FreeGenerate a real, working self-signed TLS certificate and its matching private key right in your browser using node-forge, with Subject Alternative Names, configurable key size and validity period, and ready-to-download .crt and .key files.
Runs entirely in your browser using node-forge. Your private key is never uploaded anywhere.
Certificate details
Required by modern browsers. Add every hostname or IP you will access this server by.
Optional subject fields
Certificate (.crt / .pem)
Private key (.key)
Keep this private key secret. Anyone with it can impersonate this certificate.
Recent Activity
Visible to everyone. Last 20 uses across all visitors, newest first.
Generated a self-signed certificate (CN: test.example.com, 2048-bit, valid 730 days)
47 minutes ago
What this tool does
This tool generates a real, working self-signed TLS certificate and its matching private key, right in your browser. Fill in a Common Name, the hostnames or IPs the certificate should cover (Subject Alternative Names), a key size and validity period, and get a ready-to-use certificate and key pair for local development, internal services, or testing.
How It Works
An RSA key pair is generated at your chosen size (2048 or 4096 bits). A real X.509 certificate structure is built from your subject details (Common Name and the optional Organization, Unit, Locality, State, and Country fields), your chosen validity period, and a randomly generated serial number, with keyUsage, extKeyUsage, and subjectAltName extensions set the same way a real certificate authority would set them for a TLS server certificate. The certificate is then signed with its own private key using SHA-256, which is what makes it "self-signed": the issuer and the subject are the same entity, and the signature can be verified using the certificate's own public key.
Problems it solves
- Getting HTTPS working on localhost or an internal server without needing a real certificate authority.
- Testing how your application behaves with TLS enabled before deploying a real certificate.
- Quickly producing a certificate and key pair for a Docker container, VM, or internal tool that just needs encryption in transit.
- Learning what fields actually make up an X.509 certificate by filling them in directly.
Frequently asked questions
›Will browsers show a "not secure" warning for this certificate?
Yes, and that is expected: a self-signed certificate has no chain back to a certificate authority your browser already trusts, so browsers warn about it by design. You can usually click through the warning for local development, or import the certificate into your OS or browser's trusted store if you want the warning to disappear on your own machine.
›Why do I need to fill in Subject Alternative Names, isn't the Common Name enough?
No, modern browsers (Chrome since 2017, and every major browser since) ignore the Common Name entirely for hostname matching and only check Subject Alternative Names; a certificate without a matching SAN entry will be rejected even if the Common Name is correct, which is why this tool requires at least one SAN entry and pre-fills localhost and 127.0.0.1.
›Should I pick a 2048-bit or 4096-bit key?
2048-bit RSA is still considered secure for the foreseeable future and is what almost every real certificate authority issues by default; 4096-bit is slower to generate and to use in every TLS handshake, with no practical security benefit for a local development or testing certificate, so 2048-bit is the better default unless you have a specific reason to need more.
›Is this certificate suitable for a production website?
No, a self-signed certificate is meant for local development, internal tools, or testing, visitors to a real public site will see a security warning because no browser or OS trusts it by default; for a production site, use a certificate from a real certificate authority (many of which, like Let's Encrypt, are free).
›How does this tool actually build the certificate?
It generates a real RSA key pair and a real X.509 certificate structure in your browser using the node-forge library, compiled to run client-side, then signs the certificate with its own private key (hence "self-signed") using SHA-256, exactly the same cryptographic process a certificate authority or the openssl command-line tool would use, just without ever leaving your browser.
Related Tools
Text
Hash Generator (MD5/SHA1/SHA256/SHA512)
Hash text or a file into MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, RIPEMD-160, and CRC32 all at once, with a compare field to check against a known checksum.
FreeText
htpasswd Generator
Generate a real Apache .htpasswd file with bcrypt or SHA, verified byte-for-byte against the official htpasswd command-line tool, with support for multiple users at once.
FreeText
HTML Entity Converter
Convert text to and from HTML entities in both directions at once, with decimal or hexadecimal numeric formats and a quick-reference table of common entities.
FreeText
HTML Validator
Check HTML for unclosed tags, duplicate IDs, deprecated elements, and other common well-defined issues, verified with its own tag-matching parser, not a full W3C conformance validator.
FreeText
IPv4 To IPv6 Converter
Generates IPv4-mapped, IPv4-compatible, 6to4, and NAT64 IPv6 representations of an IPv4 address, and extracts the IPv4 address back out of any of those IPv6 forms.
FreeText
JS/CSS Formatter
Reformats minified or inconsistently indented JavaScript or CSS into readable, properly indented code, with adjustable indent style and before/after size stats.
FreeText
JS/CSS Minifier
Shrinks JavaScript or CSS by removing whitespace and comments, with optional variable name mangling for JavaScript, and before/after size stats.
FreeText
JSON Encoder
Encodes plain text into a valid JSON string literal (escaping quotes, backslashes, and line breaks) and decodes it back, with an escape-character breakdown.
Comments (0)
Found this tool useful? Leave a comment, share a tip, or tell us how we can make it better.
No comments yet. Be the first to share your thoughts!