Private CA server certificate generator

Issue a server certificate backed by a CA. Generate a fresh private root CA here, or sign with a CA you already own — then install the CA once and every certificate it signs is trusted. Everything runs in your browser; nothing is uploaded.

Private CA server certificate Generate or upload your own CA RSA 2048 · SAN · PEM

A server certificate backed by a CA. Either generate a fresh private CA here, or sign with a CA you already own.

CA Common Name

CA validity (days, max 7300)

A CA has no browser-imposed lifetime limit, so 10 years (3650 days) is typical for a private root. Use ASCII characters for the name.

Server Common Name (domain)

Server certificate validity (days, max 825)

SAN — Subject Alternative Name (optional)

Separate entries with commas or spaces. The Common Name is always added automatically. Domains, wildcards and IP addresses are supported.

ca.crt Root CA certificate — install this on your devices

ca.key Root CA private key — store offline, never on the web server

server.key Private key (PEM) — never share it

server.crt Certificate (PEM), signed by the CA above

How to install the CA certificate on your computer

Installing ca.crt into the operating system trust store removes the browser warning for every certificate issued by this CA.

Graphical method

Copy ca.crt to the Windows machine.
Double-click ca.crt, then choose Install Certificate….
Select Local Machine and click Next (confirm the UAC prompt).
Choose Place all certificates in the following store → Browse…
Pick Trusted Root Certification Authorities, then Next → Finish.
Restart Chrome or Edge — they read the Windows certificate store. Firefox needs the manual import described below.

Alternative: press Win + R, run mmc, then File → Add/Remove Snap-in → Certificates → Computer account → Local computer, and import into Trusted Root Certification Authorities → Certificates.

Command line (Administrator PowerShell or CMD)

certutil -addstore -f "ROOT" ca.crt

rem verify it landed in the store
certutil -store ROOT

rem remove it later (use the CA Common Name)
certutil -delstore ROOT "My Root CA"

Graphical method

Double-click ca.crt — Keychain Access opens.
Drag the certificate into the System keychain (not login), under the Certificates category.
Double-click it, expand Trust, and set When using this certificate to Always Trust.
Close the window and enter your password to confirm.
Restart the browser. Safari, Chrome and Edge all read the System keychain.

Command line (Terminal)

sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain ca.crt

# verify
security find-certificate -c "My Root CA" /Library/Keychains/System.keychain

# remove it later
sudo security delete-certificate -c "My Root CA" /Library/Keychains/System.keychain

Command line

Debian / Ubuntu / Mint

sudo cp ca.crt /usr/local/share/ca-certificates/my-root-ca.crt
sudo update-ca-certificates

RHEL / CentOS / Fedora / Rocky / AlmaLinux

sudo cp ca.crt /etc/pki/ca-trust/source/anchors/my-root-ca.crt
sudo update-ca-trust extract

Arch / Manjaro

sudo trust anchor --store ca.crt
# remove it later
sudo trust anchor --remove ca.crt

Verify

openssl verify -CAfile ca.crt server.crt
curl --cacert ca.crt https://example.com/

Firefox keeps its own certificate store (NSS) and ignores the system store on Linux. Either import ca.crt in Settings → Privacy & Security → View Certificates → Authorities → Import, or add it with certutil (libnss3-tools on Debian/Ubuntu, nss-tools on RHEL/Fedora):

certutil -A -n "My Root CA" -t "C,," -i ca.crt -d sql:$HOME/.pki/nssdb

Deploy the server certificate in Nginx

sudo cp server.crt /etc/nginx/ssl/server.crt
sudo cp server.key /etc/nginx/ssl/server.key
sudo chmod 600 /etc/nginx/ssl/server.key

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_session_cache shared:SSL:10m;
}

sudo nginx -t
sudo systemctl reload nginx

Nginx serves a single file as ssl_certificate. Browsers already trust the CA, so the leaf certificate alone is enough — no chain file is required.

Also try: Self-Signed Certificate Generator · mTLS Certificate Generator · CSR Generator · Certificate Decoder