Self-signed certificate generator for localhost and internal servers

An online tool for creating self-signed certificates for localhost, a development machine or an internal server. It can build a small certificate authority and issue the server certificate from it, which is the arrangement that actually makes the browser warning disappear: you install the CA once and every certificate issued from it afterwards is accepted. Everything is generated in your browser through the WebCrypto API.

How to use it

1
Choose the mode

Local CA plus certificate is the one you want if the browser warning bothers you. A single self-signed certificate is fine for a quick test or an API client that skips verification.

2
List the names

Every hostname and IP you will type into the address bar. localhost and 127.0.0.1 are different names — include both.

3
Install the CA

Only in the CA mode, and only once per machine. The instructions for your platform are under the CA certificate.

4
Point your server at the files

Save the certificate and key, then use the nginx or Apache snippet below them.

Generate an HTTPS certificate for local development in one click

One per line. IP addresses are recognised automatically and go into the SAN as IP entries, which is what browsers need in order to accept https://127.0.0.1.

What it does

Local CA, not just a lone certificate
A bare self-signed certificate has to be trusted individually, and Chrome no longer offers to do that for localhost at all. A root CA is installed once and covers every certificate you issue afterwards — the same approach mkcert takes.
IP addresses handled properly
Type 127.0.0.1 or ::1 and it becomes an IP entry in the SAN, not a DNS name. Browsers require that distinction, and getting it wrong is why https://127.0.0.1 keeps failing even with a certificate that names it.
Ready-to-paste server config
nginx and Apache snippets with the right directives and file names, plus a combined certificate file in the order those servers expect.
Install instructions for six platforms
macOS, Windows, Linux, Firefox (which keeps its own store), Android (where user CAs stopped applying to apps in version 7) and Node.js/curl.
Backdated by an hour
The certificate becomes valid an hour before it is created, so a machine whose clock runs slightly slow does not reject a certificate that was made seconds ago.
ECDSA or RSA
ECDSA P-256 by default for fast handshakes, RSA 2048 or 4096 when something in the chain needs it.

Frequently asked questions

Why build a CA instead of one self-signed certificate?

Because a lone self-signed certificate has to be trusted on every machine, in every browser, one certificate at a time — and Chrome has removed the option to permanently trust one for localhost. A root CA is installed once; after that any certificate you issue from it is accepted immediately, including certificates for new projects you have not created yet. It is the same reasoning behind mkcert.

Is it safe to install a CA on my machine?

It is a real risk that deserves a clear answer: whoever holds the CA private key can issue a certificate for any website, and a machine trusting that CA will accept it. Since the key is generated in your browser and only you have it, the risk is that the key leaks. Keep it on your own machine, do not put it in a shared repository, and do not install the CA on devices you do not control. If the key does get out, remove the CA from your trust store and generate a new one.

The browser still warns after I installed the CA.

Three usual causes. Firefox keeps its own certificate store and ignores the system one — import the CA there separately. Chrome and Safari cache certificate decisions, so restart the browser completely. And the certificate itself must list the exact name you are visiting: localhost and 127.0.0.1 are different entries, and a certificate naming only one will be rejected for the other.

How long should the certificate be valid?

For local development the default of 825 days is convenient. Note that macOS and iOS reject any certificate valid for more than 825 days, even a self-signed one, so going higher will break Safari on Apple platforms. The CA itself is issued for ten years, because re-installing a root in every browser is the tedious part.

Will this work for a public website?

No, and nothing can make it. Visitors have not installed your CA, so their browsers will show a full-page warning. A public site needs a certificate from a publicly trusted authority — Let's Encrypt issues those at no cost and renews automatically.

You May Also Like

📝 CSR generator ⛓️ Certificate chain fixer 🔄 Certificate format converter 🔗 Key and certificate matcher 🧰 Let’s Encrypt troubleshooter 🔐 SSL Checker 📜 SSL certificate decoder

How do you rate this tool?

Thank you for your rating!
Want to share more? Leave a comment!
Thank you! Your comment will appear after moderation.
Who is this tool for?
💻 Developers & IT Pros 🔒 Security & Privacy
Published Updated Author: