Self-Signed Certificate Generator

Generate an RSA key + self-signed X.509 cert (with SANs) and export PEM / DER / .p12 — keys stay local.

Generate a self-signed SSL certificate and key with custom SANs, then export PEM, DER or .p12. Free, for local HTTPS — keys never leave your browser.

About Self-Signed Certificate Generator

The Self-Signed Certificate Generator creates an RSA key pair and a self-signed X.509 certificate (signed with SHA-256) entirely in your browser using node-forge, so you can enable HTTPS for local development and testing. You set the Common Name, Subject Alternative Names, validity period, and key size, then export the certificate as PEM (.crt) or DER (.der), the matching private key as PEM (.key), and optionally a password-protected PKCS#12 (.p12) bundle. It runs 100% locally with nothing uploaded and no signup — the private key never leaves the tab. Use it for things like a localhost dev server, a test TLS endpoint, or a CA-trusted cert you import yourself; it is not meant for public production sites.

How to use Self-Signed Certificate Generator

  1. Enter the Common Name (CN) for the certificate — it defaults to 'localhost'.
  2. Fill in the Subject Alternative Names as a comma-separated list of hosts and IPs (e.g. 'localhost, 127.0.0.1'); IP addresses are auto-detected and added as IP SANs.
  3. Set the validity in days (default 365, minimum 1) and pick a key size — RSA 2048 or RSA 4096.
  4. Optionally type a PKCS#12 passphrase to also produce an encrypted .p12 cert+key bundle, or leave it blank to skip.
  5. Click 'Generate certificate' and wait for the key generation to finish (4096-bit keys take longer).
  6. Copy or download the outputs: the SHA-256 fingerprint, the certificate (.crt PEM / Download DER), the private key (.key PEM), and the .p12 bundle if you set a passphrase.

Frequently asked questions

Are my keys or certificates uploaded to a server?
No. The RSA key pair and certificate are generated entirely in your browser with node-forge, and the private key never leaves the tab — nothing is uploaded.
Is it free and do I need an account?
Yes, it's completely free with no signup, account, or watermark.
What formats can I export?
You can export the certificate as PEM (.crt) or DER (.der), the private key as PEM (.key), and an optional PKCS#12 (.p12) bundle that packages the cert and key together. The .p12 is only produced when you provide a passphrase.
How do Subject Alternative Names work?
Enter a comma-separated list of hostnames and IPs. Entries matching an IPv4 pattern (like 127.0.0.1) are added as IP SANs, and everything else is added as a DNS SAN, so modern browsers that require SANs will accept the cert for those names.
What key sizes and signature does it use, and how long does it take?
It generates RSA 2048 or RSA 4096 keys and signs the certificate with SHA-256. Key generation runs synchronously in the browser, so RSA 4096 can take several seconds while the 'Generating key…' state shows.
Can I use this for a public production website?
No. Self-signed certificates are for local development and testing only — browsers will warn on them because they aren't issued by a trusted CA, so never use one for a public production site.

People also search for

Self-Signed Certificate Generator is also known as self signed cert generator online, how to create self signed certificate, generate x509 certificate, rsa key and tls dev cert, export certificate as pem or pkcs12, self signed ssl cert maker.