Self-Signed Certificate Generator
Generate a self-signed TLS certificate and private key with SANs, ECDSA P-256 or RSA 2048 and a validity of your choice, without sending the key anywhere.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a self-signed certificate
Output
Nothing generated yet
The key pair is generated and the certificate signed by Web Crypto in this browser; the private key never leaves the page. It carries the subject alternative names, a TLS server usage and a subject key identifier, which is what current browsers and curl require of a certificate. Browsers still warn until it is trusted: for local development, mkcert installs a local CA so they stop. Inspect the result with openssl x509 -in cert.pem -noout -text.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
What modern clients require
Browsers and curl ignore the common name and read the subject alternative name extension, so a certificate without SANs fails even for the name in its CN. A server certificate also needs the serverAuth extended key usage. The structure follows RFC 5280; check the result with openssl x509 -in cert.pem -noout -text.
When to self-sign
Internal services, test environments and local development, where you control the clients and can add the certificate to their trust store. For local browser work, mkcert creates a local CA and installs it so browsers stop warning. For anything public, use Let's Encrypt.