Self-Signed Certificate Generator

A certificate that vouches for itself — for a development server, an internal service, or a test. Key and certificate are both produced in your browser and never leave it.

What a self-signed certificate is

An ordinary certificate is a statement by a Certificate Authority that a public key belongs to a name. A self-signed certificate is the same document with the CA step removed: it names itself as its own issuer and signs itself with its own key. The cryptography is identical — what is missing is anybody else's word for it.

That makes it useless for a public website and perfectly good for everything else: a development server, a service two containers talk to over a private network, a test fixture, or anything where you control both ends and can decide what to trust.

How to use it

Fill in the hostname you will actually connect to, add any other names, and generate. Both files are produced in this browser tab with the Web Crypto API and are never transmitted. Reloading the page destroys them.

Get the names right, or nothing else matters

Every modern client — browsers, Go, Java, Python, curl — validates the hostname against the Subject Alternative Name list and ignores the Common Name entirely. A certificate whose CN says localhost but whose SAN list does not is rejected, and the error message rarely says why.

So list every name and address you will use: localhost, 127.0.0.1, the container name, the .test hostname, whatever appears in the URL. IPv4 literals are detected and encoded as iPAddress rather than dNSName, which is a distinction clients do enforce.

Making something trust it

Nothing trusts this certificate when it is created, by design. You have two options, and the narrow one is almost always right:

Tell one client to accept it. curl --cacert selfsigned.crt, a Go tls.Config with a custom RootCAs pool, Java's keytool -import into an application-specific truststore. Scoped to the one thing that needs it.
Add it to the machine's trust store. Convenient, and it means every application on that machine now trusts this key for those names. On a shared or long-lived machine that is a bigger decision than it looks; remember to remove it afterwards.

When not to use one

Never on anything the public can reach. A browser warning that users are trained to click past is worse than no certificate at all — it teaches the exact habit that makes a real interception attack work. For a public hostname, Let's Encrypt is free and automatic, and the ten minutes it takes to set up is less than the time spent explaining the warning to one person.

Also avoid the ten-year validity out of habit. It is offered here for lab use, but a key you cannot rotate because it is embedded in six places and expires in 2036 is a problem you are handing to someone else.