Enter the Common Name and list every hostname and IP the certificate should cover — the defaults handle the classic localhost setup.
Pick a lifetime (365 days is a sane default) and a key type — ECDSA P-256 is small, fast and universally supported.
Click "Generate certificate", then download the .crt and .key files.
Point your server at them, and trust the .crt on your machine (Keychain on macOS, certmgr on Windows, or your browser’s certificate settings) to silence the warning.
Development servers, internal dashboards and home-lab boxes all need HTTPS, and a certificate authority is overkill for a hostname the public internet can’t even reach. A self-signed certificate does the job — if it is built correctly. The catch that breaks most hand-rolled ones: modern browsers ignore the Common Name and only trust names listed as Subject Alternative Names, a step the classic one-line openssl command skips.
This generator gets that right by default: every hostname and IP you list becomes a proper SAN (127.0.0.1 as an IP entry, not a DNS one), the certificate carries the serverAuth extended key usage browsers look for, and the keypair is generated by your browser’s WebCrypto engine — nothing about your internal hostnames or keys leaves your device.
100% private“Internal hostnames are themselves sensitive — they map your infrastructure. Here the certificate, its key and every name you type are processed only in this browser tab, never uploaded or logged.”
Because nobody vouches for a self-signed certificate — that is its definition. The warning disappears once you explicitly trust the certificate on each machine that uses it. For anything customers see, use a real CA (Let’s Encrypt is free).
Chrome (and every modern browser) ignores the Common Name entirely and reads only the Subject Alternative Names. Certificates generated here always include every name as a SAN, which is exactly what fixes that error.
This tool allows up to 3650 days, and for purely internal trust that works. Note that publicly-trusted CAs are capped at 398 days and Apple platforms distrust very long-lived certificates in some contexts, so shorter is safer if iPhones or Macs must accept it.