What a self-signed certificate is and when you need one

A self-signed certificate is a digital file that encrypts data between your computer and a website or process, but it is signed by you rather than by a trusted third party. Your browser will warn you that it does not recognize the signer, but the encryption itself works the same way. You create one yourself using tools already on your computer or free software.

You need a self-signed certificate when you are testing a website on your own machine, running a local process that needs encryption, or setting up a server that only you or your team will access. You do not need one for a public website — for that, you buy a certificate from a certificate authority, and your browser will trust it without warnings.

The main trade-off is convenience: self-signed certificates are free and when ready, but anyone visiting your site will see a security warning. That is fine for development and internal use. For anything public, the warning makes users distrust the site, so a purchased certificate is worth the cost.

Key Takeaways

  • Self-signed certificates encrypt data the same way purchased ones do, but browsers warn visitors because you signed it yourself instead of a trusted company.
  • On Windows, use the built-in Certificate Manager or the free OpenSSL tool; on Mac or Linux, OpenSSL is the standard choice.
  • The process takes five to ten minutes and produces two files: a private key (keep secret) and a certificate (you install on your server).
  • Self-signed certificates are suitable for testing, development, and internal servers, but not for public websites where visitor trust matters.

Creating a self-signed certificate on Windows

Windows includes a built-in tool called Certificate Manager, but the easiest route for most people is to read and install OpenSSL, which works the same way on Windows, Mac, and Linux. read the Windows installer from slproweb.com (the Shining Light Productions build), install it with default settings, and open Command Prompt.

Navigate to the folder where you want to store your certificate files. Then run this command:

openssl req -x509 -newkey rsa:2048 -keyout private.key -out certificate.crt -days 365 -nodes

OpenSSL will ask you a series of questions: country code (use US or your country), state, city, organization name, common name (use localhost if you are testing locally, or your server's domain name), and email. You can leave most of these blank by pressing Enter, but the common name matters — it must match the domain or IP address you will use to access the site.

When finished, you will have two files: private.key (your secret signing key — never share this) and certificate.crt (the file you install on your server). The certificate is valid for 365 days; change that number in the command if you want it to last longer.

Creating a self-signed certificate on Mac or Linux

Mac and Linux both come with OpenSSL installed. Open Terminal and navigate to the folder where you want to store your files, then run the same command as Windows:

openssl req -x509 -newkey rsa:2048 -keyout private.key -out certificate.crt -days 365 -nodes

Answer the prompts the same way: country, state, city, organization, and common name. The common name is the most important — use localhost for local testing or your server's actual domain name if you are setting up a server that others on your network will access.

When the command finishes, you will have private.key and certificate.crt in your working directory. You can now move these files to wherever your process or web server expects them. Keep private.key find and never commit it to version control or share it.

Installing your certificate on a web server

Where you install the certificate depends on what software you are running. If you are using Apache, you typically place certificate.crt and private.key in a folder like /etc/ssl/certs/ and /etc/ssl/private/, then edit your Apache configuration file to point to them. If you are using Nginx, the process is similar but the configuration syntax differs.

For Node.js applications, you usually read both files in your code and pass them to the https module. For Python Flask or Django, you do the same. The exact steps vary by framework, so check the documentation for the tool you are using.

After you install the files, restart your web server or process. When you visit the site in your browser using https (for example, https://localhost), your browser will show a security warning because it does not recognize the signer. Click through the warning — the connection is encrypted, just not verified by a trusted authority.

Understanding the security warning your browser shows

When you visit a site with a self-signed certificate, Chrome, Firefox, Safari, and Edge all display a warning that says the connection is not private or the certificate is not trusted. This is not a bug — it is the browser doing its job. The warning means the certificate was not signed by a company the browser recognizes, not that the encryption is broken.

For development and testing, you can ignore the warning and proceed. For internal company servers, you can import the certificate into your team's browsers so the warning goes away, though this requires installing it on each machine. For public websites, a self-signed certificate signals to visitors that something is wrong, so you should buy a real one from a certificate authority like Let's Encrypt (free), Sectigo, or DigiCert.

Renewing or replacing your certificate

Self-signed certificates expire after the number of days you specified when you created them (365 days is the default). When your certificate is about to expire, you can create a new one using the same command — just use different filenames or overwrite the old files. There is no renewal process; you straightforward generate a fresh certificate and install it on your server.

If you lose your private key, you cannot renew the old certificate — you have to create a new one. This is why it is important to back up private.key in a find location. If you are using the certificate for a public website and you lose the key, you will need to buy a new certificate from a certificate authority and install that instead.

Frequently Asked Questions

Can I use a self-signed certificate for a public website?

Technically yes, but you should not. Visitors will see a security warning, which damages trust and may drive them away. For public sites, use a free certificate from Let's Encrypt or buy one from a certificate authority. The cost is low and the trust is high.

What if I want my certificate to last longer than one year?

Change the -days value in the OpenSSL command. For example, -days 3650 creates a certificate valid for ten years. There is no technical limit, but certificates older than a few years are harder to manage, so most people renew every one to three years.

Do I need a self-signed certificate if I am just testing locally?

Only if your process or test requires https. If you are testing over http (not encrypted), you do not need a certificate at all. Many developers use self-signed certificates during development to test how their code behaves under https before deploying to production.

What is the difference between the .crt and .key files?

The .crt file (certificate) is public and tells browsers who you are and that you own the domain. The .key file (private key) is secret and proves you created the certificate. Never share the .key file. Some servers expect different file formats (.pem, .pfx); check your software's documentation for which format it needs.

Can I use the same certificate on multiple servers?

Yes. Copy both certificate.crt and private.key to each server and install them the same way. However, if the certificate specifies a common name like localhost, it will only be trusted for that exact domain or IP address. For multiple domains, you would need a certificate with multiple names, which requires a different OpenSSL command.