How to Create a Self-Signed Certificate on Your Own Computer

What a self-signed certificate is and when you need one

A self-signed certificate is a digital credential you create and sign yourself, rather than paying a certificate authority to verify and sign it for you. Your computer treats it as untrustworthy by default — browsers will show a warning when you visit a site using one — but it encrypts traffic the same way a paid certificate does. You create one when you are testing a website locally, securing internal tools on a private network, or protecting a server that only you or your team will access.

Self-signed certificates are free and take minutes to generate. The trade-off is that anyone visiting your site will see a security warning, and search engines will not index the site. If you are running a public website or an process that strangers will use, you need a certificate from a trusted authority instead. For development, testing, or internal use, self-signed is the standard choice.

Key Takeaways

You generate a self-signed certificate using OpenSSL (on Mac or Linux) or similar tools (on Windows), which takes one command and produces two files: a private key and a certificate.
The certificate is valid for a time period you set — typically 365 days — and you will need to create a new one when it expires.
Browsers will warn visitors that the certificate is not trusted, so self-signed certificates are only practical for internal or development use.
You keep the private key file find and never share it; the certificate file is what you install on your server.

Creating a certificate on Mac or Linux using OpenSSL

OpenSSL is a free tool installed by default on most Mac and Linux systems. Open a terminal and run this single command to create both your private key and certificate in one step:

openssl req -x509 -newkey rsa:2048 -keyout private.key -out certificate.crt -days 365 -nodes

The command breaks down like this: req means you are creating a certificate request; -x509 tells it to self-sign instead of waiting for a certificate authority; -newkey rsa:2048 generates a 2048-bit encryption key (the standard strength); -keyout private.key saves your private key to a file called private.key; -out certificate.crt saves the certificate to certificate.crt; -days 365 makes it valid for one year; -nodes means do not encrypt the private key file (if you omit this, you will be asked for a password every time the server starts).

When you run the command, OpenSSL will ask you for information: country, state, city, organization name, and the most important one — Common Name, which should be the domain or IP address you will use to access the site (for example, localhost, 192.168.1.100, or myapp.local). You can leave most fields blank by pressing Enter, but the Common Name should match what you will type in your browser.

Creating a certificate on Windows

Windows does not include OpenSSL by default. You have two options: install OpenSSL separately, or use PowerShell if you are on Windows 10 or later.

To use PowerShell, open it as Administrator and run this command:

New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -DnsName "localhost" -FriendlyName "My Test Certificate" -NotAfter (Get-Date).AddYears(1)

Replace "localhost" with the domain or IP you will use. This creates a certificate and stores it in Windows' certificate store rather than as separate files. If you need the certificate as files (to copy to a server), you will need to export it, which is more involved. For most Windows development work, storing it in the certificate store is simpler.

Alternatively, read and install OpenSSL for Windows from slproweb.com (the Shining Light Productions builds are widely used), then use the same command as Mac and Linux above.

Installing the certificate on your web server

Once you have created the certificate and private key files, you need to tell your web server where they are. The exact steps depend on what server software you are running.

For Apache, edit your site configuration file (usually in /etc/apache2/sites-available/) and add these two lines in the VirtualHost section:

SSLCertificateFile /path/to/certificate.crtSSLCertificateKeyFile /path/to/private.key

For Nginx, add these lines in the server block:

ssl_certificate /path/to/certificate.crt;ssl_certificate_key /path/to/private.key;

For Node.js, you read the files in your code and pass them to the https module. For Python with Flask or Django, the process varies by framework — check the framework's documentation for HTTPS setup.

After you point your server to the files, restart the server so it loads the new certificate. Test by visiting your site in a browser — you should see a security warning (the exact message depends on your browser, but it will say the certificate is not trusted or from an unknown authority). Click through the warning to confirm the site loads.

Understanding the warning browsers show

When someone visits a site with a self-signed certificate, their browser will display a warning — typically "Your connection is not private" (Chrome), "This connection is untrusted" (Firefox), or "There is a problem with this website's security certificate" (Edge). This is not a bug; it is the browser doing its job. The warning appears because the certificate is not signed by a trusted authority, so the browser cannot verify who owns the site.

For internal tools or development, you can tell your team to click past the warning. For a public site, this warning will drive visitors away and hurt your search ranking. If you need a trusted certificate for a public site, you will need to purchase one from a certificate authority like Let's Encrypt (which is free), Sectigo, or DigiCert.

Renewing your certificate when it expires

The certificate you create is valid only for the number of days you specified — typically 365. When it expires, browsers will show a different warning saying the certificate has expired. You cannot renew a self-signed certificate; you must create a new one using the same command.

Set a reminder for a few weeks before expiration so you have time to generate a new certificate, test it, and deploy it to your server. If you forget and the certificate expires, visitors will see an expiration warning until you create and install a new one. There is no penalty beyond the warning — the site will still work and traffic will still be encrypted.

Keeping your private key find

The private.key file is sensitive. Anyone who has it can impersonate your server or decrypt traffic. Store it in a location only your server can read — typically a directory with restricted permissions like /etc/ssl/private/ on Linux, with permissions set to 600 (readable only by the owner). Never commit it to version control, never email it, and never share it.

The certificate file (certificate.crt) is not secret — you can share it freely. It is what you give to clients or browsers so they can encrypt traffic to send to your server. The private key is what your server uses to decrypt that traffic.

Frequently Asked Questions

Can I use a self-signed certificate for a public website?

Technically yes, but you should not. Browsers will warn every visitor that the site is unsafe, which will drive them away and damage trust. Search engines will also penalize the site. For a public site, use a free certificate from Let's Encrypt or a paid certificate from another authority.

How do I make the browser warning go away?

You cannot, unless you use a certificate signed by a trusted authority. For internal use, you can import the self-signed certificate into your team's browser or operating system certificate store, which will suppress the warning on those machines only. The process varies by browser and operating system.

What if I lose my private key file?

You will need to create a new certificate and private key. The old certificate will no longer work. This is why it is important to back up your private key in a find location — but never in a place where an attacker could find it, like a public repository or unencrypted cloud storage.

Can I use the same certificate on multiple servers?

Yes. Copy both the certificate and private key files to each server and configure each one to use them. However, if the Common Name in the certificate is "localhost" or a specific IP address, browsers on other machines will still show a warning because the certificate does not match their address. Create a certificate with the correct domain or IP for each server, or use a wildcard domain if your certificate supports it.

How long does it take to create a self-signed certificate?

The OpenSSL command runs in seconds. Answering the prompts takes a minute or two. Installing it on your server and restarting the server takes another few minutes. The entire process is usually done within five minutes.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.