Generate self-signed SSL/TLS certificates for local development and testing. Includes Subject Alternative Names support
Need a self-signed certificate for local development or internal testing? Generate one here in seconds, set the domain, validity period, and key type, then download the cert and key pair.
Initializing in your browser…
Generate Certificate Signing Requests (CSR) for SSL/TLS certificates with RSA key pairs. Submit to CAs for certificate issuance
Decode and analyze PEM-encoded X.509 SSL/TLS certificates. View subject, issuer, validity, extensions, and fingerprints
Check if a website has valid SSL/TLS certificate. Verify HTTPS connection and get tools for detailed certificate analysis
You need HTTPS on a local dev box (https://localhost:8443) without paying a CA or fighting an internal PKI.
Inputs
CN localhost · SAN localhost, 127.0.0.1 · Validity 365 days · Key RSA 2048
Cert + key (PEM)
-----BEGIN CERTIFICATE----- (server.crt, self-signed) -----BEGIN PRIVATE KEY----- (server.key, load into your dev server) Note: browsers will warn "not trusted" until you add this cert to your OS/browser trust store, expected for self-signed.
A self-signed certificate is signed by its own key rather than a trusted CA, which is perfectly fine for local development and internal testing. Including `127.0.0.1` and `localhost` as SANs is essential, modern browsers reject certs that lack a matching SAN even on localhost. Everything is generated client-side.
Need a self-signed certificate for local development or internal testing? Generate one here in seconds, set the domain, validity period, and key type, then download the cert and key pair.
Run your dev server over HTTPS without buying a certificate or setting up Let's Encrypt locally.
Encrypt traffic between internal services on a private network where public CA trust isn't needed.
Generate throwaway certs to test server TLS settings, cipher suites, and client certificate validation.
Not by default. You'll see a security warning that you can bypass for development. For production, use a certificate from a trusted CA.
For local dev, 365 days is typical. For internal services, match your organization's certificate rotation policy.
This runs as client-side JavaScript. Keys, tokens, payloads, and other inputs never leave your device.