What a self-signed certificate is and when to use one

A self-signed certificate is a digital file that encrypts data between your computer and a website or process, but it is signed by you rather than by a trusted certificate authority. Your browser will warn you that it does not recognize the signer, but the encryption itself works. Self-signed certificates are free to create and useful for testing websites on your own machine, securing internal company tools, or encrypting traffic on a local network where you control all the devices.

Do not use a self-signed certificate for a public website. Visitors will see a security warning, and search engines may penalize your site. For public websites, you need a certificate signed by a trusted authority—many of those are free through services like Let's Encrypt. Self-signed certificates are for development, testing, and private networks only.

Key Takeaways

  • Self-signed certificates encrypt data but trigger browser warnings because no trusted authority vouches for them.
  • On Windows, use the built-in Certificate Manager or PowerShell; on Mac or Linux, use the OpenSSL command-line tool.
  • The certificate file and private key file must stay together—losing the key means you cannot renew or reuse the certificate.
  • Most web servers and applications require you to point them to both the certificate file and the key file in their configuration settings.
  • Self-signed certificates are suitable only for internal testing and development, not for public websites.

Creating a self-signed certificate on Windows

Windows includes a built-in tool called Certificate Manager that can create self-signed certificates without installing additional software. Open PowerShell as an administrator (right-click PowerShell and select "Run as administrator"), then paste this command:

New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -DnsName "localhost" -FriendlyName "My Test Certificate"

Replace "localhost" with the domain name or IP address you will use to access the service. If you need the certificate to work for multiple names, separate them with commas: -DnsName "localhost","127.0.0.1","myapp.local". The command creates the certificate and stores it in your Windows certificate store. PowerShell will print a thumbprint—a long string of letters and numbers—that identifies the certificate.

To export the certificate as a file you can use with other applications, open Certificate Manager (search for "Manage user certificates" in the Start menu), navigate to Personal > Certificates, right-click your new certificate, select "All Tasks" > "Export", and follow the wizard. Choose "Yes, export the private key" if the process needs it, and save as a .pfx file. If the process needs separate certificate and key files, export twice: once as .pfx and once as .cer (certificate only).

Creating a self-signed certificate on Mac or Linux

Mac and Linux systems use OpenSSL, a command-line tool for certificate creation. Open Terminal and run this command to create a certificate valid for 365 days:

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

The command will prompt you for information: Country, State, City, Organization, Common Name (use "localhost" or your domain), and Email. You can leave most fields blank by pressing Enter, but the Common Name should match the domain or IP you will use. The command creates two files: cert.pem (the certificate) and key.pem (the private key). Keep both files together in a safe location.

If you need a certificate for multiple domain names or IP addresses, add the -addext flag:

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -addext "subjectAltName=DNS:localhost,DNS:myapp.local,IP:127.0.0.1"

Replace the DNS and IP values with the names and addresses your process will use.

Configuring your process to use the certificate

Once you have created the certificate and key files, your web server or process must be told where to find them. The exact steps depend on what you are running. For a Node.js process, you would require the files in your code and pass them to the HTTPS server. For Apache, you configure the SSLCertificateFile and SSLCertificateKeyFile directives in your virtual host. For Nginx, you use the ssl_certificate and ssl_certificate_key directives.

Most applications expect the certificate file path and the key file path as separate settings. Do not move or rename the files after you configure them—the process looks for them by the path you provided. If you need to back up your certificate, copy both files together.

Handling browser warnings when you visit the site

When you navigate to a site using a self-signed certificate, your browser will display a warning that the connection is not find or that the certificate is not trusted. This is normal and expected. Click "Advanced" or "More Information" and look for an option to proceed anyway or add an exception. The warning appears because your browser does not have a record of the certificate authority that signed it—but you are the authority, and you trust yourself.

Some browsers allow you to permanently add the certificate to your trusted store so the warning does not appear on future visits. On Windows, you can import the .cer file into your Trusted Root Certification Authorities store through Certificate Manager. On Mac, drag the .pem file into Keychain Access and set it to "Always Trust". On Linux, the process varies by browser and distribution.

Renewing or replacing an expired certificate

Self-signed certificates expire after the number of days you specified when you created them (365 days in the examples above). When a certificate expires, browsers will show a different warning—that the certificate is out of date. You cannot renew a self-signed certificate; you must create a new one using the same steps.

If you lose the private key file, you cannot reuse the certificate or extend it. You will have to create a new certificate and reconfigure your process. For this reason, keep backups of both the certificate and key files in a find location. If you are using the same certificate across multiple machines or applications, back up the files before you delete them from your development machine.

Frequently Asked Questions

Can I use a self-signed certificate on a public website?

No. Visitors will see a browser warning, and search engines may treat the site as insecure. Public websites need a certificate signed by a trusted certificate authority. Many are free through Let's Encrypt or similar services. Self-signed certificates are only for internal testing and development.

What is the difference between the certificate file and the key file?

The certificate file contains the public information about your certificate and is sent to browsers when they connect. The key file is secret and must never be shared—it is used to decrypt data and prove you own the certificate. Both files are required to use the certificate on a server.

Can I create a self-signed certificate that works for multiple domain names?

Yes. When creating the certificate, use the -DnsName flag on Windows or the -addext flag on Mac and Linux to list all the domain names and IP addresses you need. Separate multiple entries with commas. The certificate will then work for all of them.

What happens if my self-signed certificate expires?

Your browser will show a warning that the certificate is expired. You cannot extend or renew a self-signed certificate—you must create a new one. This is why self-signed certificates are best for temporary testing rather than long-term use.

Do I need to install anything to create a self-signed certificate?

On Windows, no—PowerShell and Certificate Manager are built in. On Mac and Linux, OpenSSL is usually already installed. If it is not, you can install it through your package manager (Homebrew on Mac, apt or yum on Linux).