Self-Signed Certificate Generator for localhost, Local Domains and IP Addresses
This self-signed certificate generator turns the names your local site uses into a certificate
and private key you can drop straight into a development server. Every name goes into the Subject Alternative
Name list, which is what modern browsers check, and you download server.crt and
server.key as one ZIP. The key pair is created in your browser and nothing is uploaded or saved.
How to Generate a Self-Signed Certificate
- Check the Domains and IP addresses box. It starts with
localhost, 127.0.0.1; replace or extend it with the names you use, for examplelocalhost, 127.0.0.1, 192.168.1.5. - Optionally open Settings to change Valid for (days) or RSA key size.
- Press Generate certificate. After a short Generating your certificate… step, Your certificate is ready appears.
- Press Download ZIP. The file
local-ssl-certificate.zipholdsserver.crt(the certificate) andserver.key(the private key). - Add
server.crtto your computer's trust store using Trust it on your computer, then set up your server with the two files. - To change a name or setting, press Change names or settings and generate again.
What to Type in Domains and IP Addresses
Separate entries with commas, spaces or new lines. Each one is sorted automatically into a DNS name or an IP address:
- Host names such as
localhostordev.example.test. - Wildcards such as
*.example.test, which match one level of subdomain. - IPv4 addresses such as
192.168.1.5and IPv6 addresses such as::1, with or without square brackets. - Names with accented or non-Latin letters, which are converted to punycode (the
xn--form) for you.
A certificate can cover up to 50 names. Type only the host name or address: an entry with a scheme such as
https:// or with a port number is rejected, and the error lists exactly which entries were not valid
so you can fix them. The name you type in the browser's address bar must be one of the
names on the certificate, or the browser will still complain.
Settings: Validity and Key Size
Valid for (days) accepts 1 to 397 and starts at 365. A number outside that range is changed to the nearest limit. The certificate is valid from the moment you generate it, and Valid until in the result shows the end date. When it runs out, generate a new one.
RSA key size is 2048 bits by default, which is fast and accepted everywhere. Choose 4096 bits for a larger key; it can take a few seconds to create.
What Is Inside the Certificate
The result shows Covers (every name, as chips), Valid until, Key and the SHA-256 fingerprint. The certificate itself is built like this:
| Field | Value |
|---|---|
| Type | Self-signed X.509 version 3, signed with its own key using SHA-256 with RSA |
| Subject Alternative Name | Each domain as a DNS name, each IP address as an IP address entry |
| Common name | The first entry you typed (browsers ignore it and read the SAN) |
| Extended key usage | serverAuth, so it can identify a web server |
| Basic constraints | CA:TRUE, so it can be added to a trust store as its own root |
| Key usage | digitalSignature, keyEncipherment, keyCertSign |
| Serial number | Random |
server.key is a PEM private key in PKCS#8 form (it starts with -----BEGIN PRIVATE KEY-----),
and server.crt is a PEM certificate. There is no OpenSSL step and no command to remember.
Trust a Self-Signed Certificate on Your Computer
A browser warns about a self-signed certificate until it is added to the trust store. Unzip the download, open a terminal in that folder and run the command for your system. Each one is also shown ready to copy under Trust it on your computer:
- macOS:
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain server.crt - Windows (PowerShell as administrator):
Import-Certificate -FilePath .\server.crt -CertStoreLocation Cert:\LocalMachine\Root - Debian and Ubuntu:
sudo cp server.crt /usr/local/share/ca-certificates/server.crt && sudo update-ca-certificates - Fedora and RHEL:
sudo cp server.crt /etc/pki/ca-trust/source/anchors/ && sudo update-ca-trust
Firefox keeps its own list, and so does Chrome on Linux. In those, import server.crt under Settings,
Certificates, Authorities. Some programming tools and runtimes also keep their own list; if one still complains,
give it server.crt in its own settings. Restart the browser after trusting the certificate.
Use the Certificate in Your Server
Point your web server's certificate setting at server.crt and its private key setting at
server.key, then restart the server. In nginx these are ssl_certificate and
ssl_certificate_key; in Apache they are SSLCertificateFile and
SSLCertificateKeyFile. Then open your site by one of the names on the certificate, with
https:// in front.
Is It Safe to Create a Private Key in a Browser?
The key pair is made with your browser's own WebCrypto, and the certificate is built and signed on the page.
Nothing is uploaded and nothing is saved, so the ZIP you download is the only copy. Keep
server.key private: anyone who has it can pose as your local site. Do not commit it to a public
repository.
Frequently Asked Questions
How do I create a self-signed certificate for localhost?
Leave localhost, 127.0.0.1 in the Domains and IP addresses box (it is filled in already), press Generate certificate, then Download ZIP. You get server.crt and server.key. Point your local web server at those two files and add server.crt to your computer's trust store so the browser stops warning.
Can I make a self-signed certificate for an IP address?
Yes. Type the address in the Domains and IP addresses box, for example 192.168.1.5. IPv4 and IPv6 both work, and so does the bracketed form [::1]. Each IP is written into the certificate as an IP address entry, which is what browsers check when you open https://192.168.1.5. Type just the address, without https:// or a port.
How do I generate a self-signed certificate with SAN?
Every name you enter becomes a Subject Alternative Name automatically: domains as DNS names, IP addresses as IP address entries. There is nothing to configure or paste. The Covers list in the result shows every name that went in. The common name is set to the first entry you typed, but browsers read the SAN, not the common name.
Can I create a self-signed wildcard certificate?
Yes. Enter a wildcard such as *.example.test and it is added as a DNS name. A wildcard matches one level, so *.example.test covers app.example.test but not example.test itself or a.b.example.test. List example.test separately if you need it.
How do I trust a self-signed certificate on a Mac?
Unzip the download, then run sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain server.crt in the folder that holds server.crt. The exact command is shown, ready to copy, under Trust it on your computer. Restart the browser afterwards if it still warns.
How do I trust a self-signed certificate on Windows 11?
Open PowerShell as administrator, go to the folder where you unzipped the files and run Import-Certificate -FilePath .\server.crt -CertStoreLocation Cert:\LocalMachine\Root. It copies the certificate into the Trusted Root store, which Chrome and Edge read.
How do I trust a self-signed certificate on Ubuntu?
On Debian and Ubuntu, run sudo cp server.crt /usr/local/share/ca-certificates/server.crt && sudo update-ca-certificates in the folder holding the file. Command-line tools such as curl then accept it. Firefox, and Chrome on Linux, keep their own list, so import server.crt there as well.
How do I trust a self-signed certificate in Firefox?
Firefox does not use the system trust store. In its settings, find Certificates, choose View Certificates, open the Authorities tab, and import server.crt, ticking the option to trust it for websites. Chrome on Linux keeps its own list in the same way.
Do I need OpenSSL to create a self-signed certificate?
No. The key pair is made by your browser's built-in WebCrypto and the certificate is built and signed in the page, so there is no command to run and nothing to install. OpenSSL is only used here if you want to convert the files afterwards.
Can I get a PFX file, a CSR or a Let's Encrypt certificate?
No. This makes one self-signed certificate in PEM format: server.crt and server.key. It does not create a certificate signing request, a CA-signed or public certificate, or a separate root CA plus a signed certificate. If a tool needs a PFX, OpenSSL's pkcs12 command can build one from the two files.
How long can a self-signed certificate last?
Here, from 1 to 397 days, set under Settings in Valid for (days). The default is 365. A number outside that range is changed to the nearest limit. Generate a new certificate when it runs out; the Valid until line in the result shows the date.
Is a self-signed certificate secure?
The encryption is as strong as any other certificate of the same key size, but nobody vouches for who you are, so only machines you set up to trust it will accept it. That makes it right for development and testing on your own machine or network, and wrong for a public website. Keep server.key private: whoever holds it can pose as your local site.
How do I use the certificate with nginx or Apache on localhost?
Point the server's certificate setting at server.crt and its key setting at server.key, then restart it. In nginx those are ssl_certificate and ssl_certificate_key; in Apache they are SSLCertificateFile and SSLCertificateKeyFile. Use a name or IP that you entered in the Domains and IP addresses box.
Recommended
-
Lamicall 360° Rotating Tablet StandProp up the phone or tablet you open https://192.168.x.x on while you test.
-
Kingston IronKey Vault Privacy 50 Encrypted USBA hardware-encrypted drive to keep server.key off your laptop's plain disk.
-
EMEET S600 4K Streaming WebcamCamera tests need HTTPS, so test the real thing with a proper 4K webcam.
Helps keep the tools free. ✨
Images are for illustration only. As an Amazon Associate I earn from qualifying purchases.
