Self-Signed Certificate Generator
Subject details — every field below is optional; only the Common Name above is required.
Subject details — every field below is optional; only the Common Name above is required.
Enter the Common Name and list every hostname and IP the certificate should cover — the defaults handle the classic localhost setup.
Optionally complete the subject: Organization, Organizational Unit, two-letter Country, State/Province, Locality and email address — all end up in the certificate’s DN.
Pick a lifetime (365 days is a sane default) and a key type — ECDSA P-256 is small, fast and universally supported.
To ship a protected key, set a passphrase — the private key is then AES-256 encrypted (PKCS#8), the same format openssl produces.
Click "Generate certificate", download the .crt and .key, point your server at them, and trust the .crt on your machine to silence the warning.
Development servers, internal dashboards and home-lab boxes all need HTTPS, and a certificate authority is overkill for a hostname the public internet can’t even reach. A self-signed certificate does the job — if it is built correctly. The catch that breaks most hand-rolled ones: modern browsers ignore the Common Name and only trust names listed as Subject Alternative Names, a step the classic one-line openssl command skips.
This generator gets that right by default: every hostname and IP you list becomes a proper SAN (127.0.0.1 as an IP entry, not a DNS one), the certificate carries the serverAuth extended key usage browsers look for, and the keypair is generated by your browser’s WebCrypto engine — nothing about your internal hostnames or keys leaves your device.
100% private“Internal hostnames are themselves sensitive — they map your infrastructure. Here the certificate, its key and every name you type are processed only in this browser tab, never uploaded or logged.”
Because nobody vouches for a self-signed certificate — that is its definition. The warning disappears once you explicitly trust the certificate on each machine that uses it. For anything customers see, use a real CA (Let’s Encrypt is free).
Chrome (and every modern browser) ignores the Common Name entirely and reads only the Subject Alternative Names. Certificates generated here always include every name as a SAN, which is exactly what fixes that error.
If the key will sit on a laptop or be sent to someone, yes — the passphrase encrypts it with AES-256 so the file alone is useless. For a server that must start unattended, an unencrypted key is the usual choice (or your server prompts for the passphrase at startup: nginx and Apache both can).
This tool allows up to 3650 days, and for purely internal trust that works. Note that publicly-trusted CAs are capped at 398 days and Apple platforms distrust very long-lived certificates in some contexts, so shorter is safer if iPhones or Macs must accept it.