Certificate Generator

Generate a root CA certificate and server certificate (self-signed certificate). Everything happens in the browser; nothing, including private keys, is sent to a server.

1. Prepare a Root CA

2. Generate a Server Certificate

Common Name (CN)Organization (O, optional)Validity Period (days)Key Size

SAN (Subject Alternative Name, comma or newline separated; supports domain names and IP addresses)

Signing Method

Self-signed

The simplest method, where the certificate is its own issuer. No CA is required, but browsers and OSes don't recognize the issuer, so a warning appears every time it's accessed. Suited for testing a single server on your own.

Sign with the generated root CANot ready — generate a root CA above first

Sign with the private key of the CA generated (or uploaded) in the section above. Once the CA certificate is imported into an OS or browser as a trusted root certification authority, every server certificate signed by that CA is trusted without warnings. Suited for issuing and managing certificates for multiple servers or domains under a single CA.

Sign with the uploaded CANot ready — upload a CA above first

Upload the certificate and private key of an existing CA (e.g., one generated in a previous session of this tool, or a CA shared within your team) and sign with it. It works the same way as "Sign with the generated root CA", but lets you reuse a CA that is already imported into a trust store.

About This Tool

Certificate generation happens entirely in the browser; nothing, including private keys, is sent to a server.
Reloading the page discards the generated keys and certificates, so download them if you need to keep them.
To have a browser or OS trust a server certificate signed by the root CA, the CA certificate must be imported as a trusted root certification authority.
Certificates generated by this tool are intended for local development and testing. Use certificates issued by a certificate authority in production.