How to Generate a Self-Signed SSL Certificate (Free, Online)

If you are developing locally or running an internal service that needs HTTPS, a self-signed SSL certificate is the fastest solution. Unlike certificates from a Certificate Authority (CA), self-signed certs can be generated instantly for free — but browsers will show a warning for public-facing sites, which is why they are only suitable for development and internal use.

Option 1: Generate Online (No Tools Required)

The fastest approach is our free SSL Certificate Generator. Fill in your domain (localhost, an IP address or internal hostname), organisation details and validity period, then click Generate. You get a certificate and private key ready to paste into your server config or download as PEM files.

The generation uses the Web Crypto API and runs entirely in your browser — the private key is never transmitted to our servers.

Option 2: Generate with OpenSSL (Command Line)

If you have OpenSSL installed (standard on macOS and Linux, available on Windows via WSL or Git Bash), a single command generates a certificate and key:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650 -nodes -subj "/C=US/O=Dev/CN=localhost"

For a certificate with Subject Alternative Names (required by modern browsers), use:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650 -nodes   -subj "/CN=localhost"   -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

Option 3: mkcert for Local Development

mkcert is a tool that generates locally-trusted certificates — no browser warning — by creating a local CA and adding it to your system trust store. Install with:

brew install mkcert    # macOS
mkcert -install
mkcert localhost 127.0.0.1 ::1

This creates localhost+2.pem and localhost+2-key.pem, trusted by Chrome, Firefox and Safari without any security warnings. This is the recommended approach for local development.

Using the Certificate

Nginx:

ssl_certificate     /path/to/cert.pem;
ssl_certificate_key /path/to/key.pem;

Apache:

SSLCertificateFile    /path/to/cert.pem
SSLCertificateKeyFile /path/to/key.pem

Node.js:

const https = require('https');
const fs = require('fs');
https.createServer({
  key: fs.readFileSync('key.pem'),
  cert: fs.readFileSync('cert.pem')
}, app).listen(443);

For Production Sites: Use Let's Encrypt Instead

Self-signed certificates are not suitable for public websites — all visitors will see a browser security warning. For production, use Let's Encrypt via Certbot, which provides free, automatically-renewing, CA-trusted certificates in minutes.

After setting up any SSL certificate, verify it is working correctly with our SSL Certificate Checker.