Self-signed certificate generator

Create an RSA 2048 key pair and an X.509 certificate entirely in your browser, with a modern browser-ready SAN extension. Nothing is uploaded — the key never leaves your device.

Self-signed server certificate RSA 2048 · SAN · PEM

A single self-signed leaf certificate. Browsers will show a warning until you add an exception, because no CA is involved.

Separate entries with commas or spaces. The Common Name is always added automatically. Domains, wildcards (*.example.com) and IP addresses are supported — IPs are written as IP entries, not DNS entries.

server.key Private key (PEM) — never share it
server.crt Certificate (PEM)

How to configure this certificate in Nginx

1. Copy the files to the server

Keep the private key readable by root only.

sudo mkdir -p /etc/nginx/ssl
sudo cp server.crt /etc/nginx/ssl/server.crt
sudo cp server.key /etc/nginx/ssl/server.key
sudo chmod 644 /etc/nginx/ssl/server.crt
sudo chmod 600 /etc/nginx/ssl/server.key

2. Reference them from a server block

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate     /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    add_header Strict-Transport-Security "max-age=31536000" always;

    root /var/www/html;
    index index.html;
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

3. Test and reload

sudo nginx -t
sudo systemctl reload nginx

4. Verify from another machine

curl -vk https://example.com/
openssl s_client -connect example.com:443 -servername example.com </dev/null

Because this certificate is self-signed with no CA behind it, browsers will still warn. Use the private CA generator or the mTLS generator and install the CA certificate on your computer to get a clean green lock across every site you issue.

Also try: Private CA Certificate Generator · mTLS Certificate Generator · CSR Generator · Certificate Decoder