Self-signed certificate
Create a self-signed TLS certificate and private key for development and testing from host names and IP addresses, one per line. The key is generated in the browser.
Process locally
Files stay in this browser session. Closing or clearing releases them.
Add text
Type or paste the text to process
Adjust settings
Optional: Key type, Valid for, Organization
Run
Processes in this browser; cancel at any time
About this tool
Create a self-signed TLS certificate and its private key for local development and testing, for example to serve https://localhost, to test a service on an internal IP address, or to try out HTTPS settings before you have a real certificate.
Enter up to 100 host names or IP addresses, one per line: the first becomes the common name (CN), and all of them go into the subject alternative names (SAN). Wildcards such as *.example.test and internationalized domain names work. The key is ECDSA P-256 or P-384, or RSA 2048 to 4096, generated in your browser and not uploaded.
How to use it
- Enter host names and IP addresses, one per line, or select Use example to load localhost, 127.0.0.1, ::1 and dev.example.test.
- Choose the “Key type” (ECDSA P-256 by default) and how many days the certificate is “Valid for” (1 to 3650, 365 by default).
- Optionally enter an “Organization”.
- Select Run, then download certificate.pem and private-key.pem, or both together as a ZIP.
Formats and limits
- Input
- Text
- Output
- PEM
- Size limit
- 64 KB
- Settings
- Key type (ECDSA P-256, ECDSA P-384, RSA 2048, RSA 3072, RSA 4096); Valid for; Organization
- Privacy
- Files stay in the current browser session. No file bytes are uploaded.
- Price
- Free, no sign-up
Common questions
Why does the browser still show a warning?
No public CA vouches for a self-signed certificate, so browsers warn until you trust it on that device, for example by importing certificate.pem into the system or browser certificate store. Do this only on machines you use for development.
What does the certificate contain?
It is an X.509 v3 certificate signed with SHA-256 (SHA-384 for P-384), marked as not a CA, for server and client authentication, with the key usage digitalSignature (plus keyEncipherment for RSA). It becomes valid one minute before it is created and has a random serial number.
Which key type should I choose?
ECDSA P-256 is the default and generates quickly. Choose RSA if the software you test with needs an RSA key; RSA 4096 is noticeably slower to generate.
In which format are the files?
certificate.pem holds the certificate (BEGIN CERTIFICATE), and private-key.pem the unencrypted private key in PKCS #8 (BEGIN PRIVATE KEY), PEM files that servers such as nginx take directly. To inspect the certificate, paste it into the “Certificate decoder”.
Which entries are accepted?
Host names, which are lowercased and converted to punycode if they contain non-ASCII characters, a leading *. wildcard, IPv4 addresses, and IPv6 addresses with or without brackets. Empty lines and duplicates are skipped, and an invalid entry stops the run and is named in the error.
Related tools
Certificate decoder
Read PEM certificates and certificate requests: subject, issuer, validity, alternative names, public key, key usages, other extensions and fingerprints.
Key pair generator
Generate RSA, ECDSA (P-256, P-384, P-521), Ed25519 or SM2 key pairs as PEM in PKCS #8 or traditional form, for JWT, TLS or encryption tests.
PFX/P12 to PEM
Export the private key, certificates and public key from a PFX or P12 file as PEM, including files from OpenSSL 3 (AES) and older RC2 or 3DES ones.
RSA and SM2 encryption and signatures
Encrypt, decrypt, sign or verify text with an RSA key (PEM: PKCS #1, PKCS #8, public key or certificate) or an SM2 key (hex or PEM). Keys stay in the browser and are never saved with workflows.
Caesar cipher and Morse code
Encrypt or decrypt with the Caesar cipher (any shift), ROT13, ROT47 or Atbash, or encode and decode international Morse code.
Symmetric encryption (AES, SM4, DES)
Encrypt or decrypt text with AES (CBC, ECB, CTR, CFB, OFB or GCM), SM4, DES, Triple DES, Blowfish, RC2, RC5, RC6, RC4, Rabbit or XOR. The key is a separate input and is never saved with workflows.