Self-Signed Certificate & CSR Generator
Create a self-signed X.509 TLS certificate, a CA certificate or a CSR with SANs, RSA 2048–4096 keys and custom validity. PEM output; the key never leaves you.
Usually the host name, e.g. localhost or www.example.com.
Extra DNS names and IP addresses, separated by commas or new lines. Browsers check these, not the CN.
The RSA key is created with Web Crypto in your browser and never leaves your device.
What is SSL Certificate Generator?
Generate the files you need for TLS without the OpenSSL command line: a self-signed TLS certificate for local development or internal services, a self-signed CA certificate to sign your own certificates, or a certificate signing request (CSR) to send to a certificate authority. You get the certificate or CSR and the RSA private key in PEM format, plus the SHA-256 fingerprint.
How to use SSL Certificate Generator
- Choose What to create.
- Enter the Common Name (CN) and the Subject Alternative Names (DNS names and IPs), plus optional organization and location fields.
- Choose the Key size and, for certificates, the Validity (days).
- Click Generate and download the certificate (
.crt) or CSR (.csr) and the private key (.key).
Example
Self-signed TLS certificate, CN localhost, SANs 127.0.0.1 and ::1, RSA 2048, 365 days
-----BEGIN CERTIFICATE----- … -----END CERTIFICATE----- Subject: CN=localhost SAN: DNS:localhost, IP:127.0.0.1, IP:::1
When to use SSL Certificate Generator
Use self-signed certificates for localhost, development containers, intranet services, IoT prototypes and testing TLS configuration. Browsers show a warning until you trust the certificate (or your CA). For public websites use a CA such as Let's Encrypt: create a CSR here or let your server or ACME client generate one.
How SSL Certificate Generator works
An RSA key pair is generated with the browser's Web Crypto API (RSASSA-PKCS1-v1_5, public exponent 65537) and imported into node-forge. For certificates, forge builds an X.509 v3 certificate with a random 128-bit positive serial number, validity from one minute ago for the chosen number of days, identical subject and issuer (self-signed), and extensions: basicConstraints (CA true/false, critical), keyUsage (digitalSignature + keyEncipherment for servers, keyCertSign + cRLSign for CAs), extendedKeyUsage serverAuth/clientAuth, subjectKeyIdentifier and subjectAltName. The CN is added to the SANs automatically when it is a host name or IP. It is signed with SHA-256. CSRs are PKCS#10 requests carrying the SANs in an extensionRequest attribute. Keys are exported as PKCS#8 PEM.
Common Use Cases
- Enabling HTTPS on localhost or a development server
- Creating a private CA for an internal network or lab
- Generating a CSR for a commercial certificate
- Testing TLS settings in Nginx, Apache or a load balancer
Security Note
Anyone with the private key can impersonate your server. Keep the .key file private, do not commit it to Git, and do not reuse development keys in production.
FAQs
Why does my browser say the certificate is not trusted?
A self-signed certificate is not issued by a CA your system trusts. Import it (or the CA that signed it) into your operating system or browser trust store to remove the warning on your own machines.
Why are Subject Alternative Names required?
Modern browsers ignore the Common Name and only match the host name against the SAN list, so every host name and IP you use must be listed there.
Is the private key safe?
It is generated in your browser and never sent anywhere. Download it, store it with restricted permissions and never share it.
Which key size should I choose?
RSA 2048 is the common minimum and widely compatible; 3072 or 4096 give more margin at the cost of slower handshakes.