Self-Signed Certificate Generator (localhost SSL)
Create a self-signed X.509 certificate and private key in your browser for localhost or a test server: SANs, validity, ECDSA or RSA, plus the matching openssl command.
Local development, internal dashboards and test servers often need HTTPS before a real certificate is available. This generator creates a self-signed X.509 v3 certificate and its private key in your browser: subject alternative names for every hostname and IP, a validity you choose, ECDSA or RSA keys, the right key-usage extensions, and the equivalent openssl command. It can also make a root CA certificate for signing your own server certificates.
How to use this tool
- Enter the main name (often localhost) and every DNS name and IP address clients will use.
- Choose the validity, the key type and whether you need a server certificate or a root CA.
- Press the button and save the .crt and .key files.
- Point your server at both files and trust the certificate on the devices that connect.
Formula
Certificate = SEQUENCE { TBSCertificate { v3, 128-bit random serial, signature algorithm, issuer = subject, validity, subject, public key, extensions }, signature algorithm, signature over the TBS }
Extensions: basicConstraints (critical), keyUsage (critical), extendedKeyUsage serverAuth/clientAuth, subjectAltName, and subject/authority key identifiers (SHA-1 of the public key). The signature is ECDSA with SHA-256 (SHA-384 for P-384) or RSA PKCS#1 v1.5 with SHA-256.
Example
The defaults make a certificate for CN=localhost with SANs DNS:localhost, IP Address:127.0.0.1 and IP Address:0:0:0:0:0:0:0:1 (::1), valid for 365 days, with an ECDSA P-256 key. Its self-signature verifies, and openssl x509 -text shows the same extensions.
Frequently asked questions
Why does the browser still warn?
A self-signed certificate vouches only for itself. Import it (or the root CA you made) into the operating system or browser trust store on each device; then the warning goes away for the names in the SAN list.
Can I use this on a public website?
No. Visitors would see a security warning. Use a free certificate from a public CA such as Let’s Encrypt for anything on the internet.
Why is there no passphrase on the key?
Web servers usually need to read the key at start-up without a prompt. Protect the file with permissions (chmod 600), or encrypt a copy with openssl pkey -aes256 if you need to store it elsewhere.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/self-signed-certificate-generator/
Cite or embed this tool
kakaoCalc. (2026, November 8). Self-Signed Certificate Generator (localhost SSL). https://kakao.mobile/tools/self-signed-certificate-generator/
“Self-Signed Certificate Generator (localhost SSL).” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/self-signed-certificate-generator/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms