What a self-signed certificate is and when to use one

A self-signed certificate is a digital credential you create and sign yourself, rather than paying a certificate authority to sign it for you. When you self-sign, you are both the creator and the authority vouching for the certificate's legitimacy. Your computer trusts it because you told it to, not because an outside organization verified your identity.

Self-signed certificates work well for testing, internal networks, and personal projects where you control both the server and the devices connecting to it. They are free and take minutes to generate. However, web browsers will warn visitors that the certificate is not trusted by a recognized authority, so they are not suitable for public websites where strangers need confidence in your identity.

Common uses include securing a local development server, encrypting traffic on a private network, testing HTTPS before buying a real certificate, or protecting internal tools that only your team accesses.

Key Takeaways

  • Self-signed certificates are created on your own computer using command-line tools like OpenSSL, which is free and built into most systems.
  • The process generates two files: a private key (kept secret) and a certificate file (installed on your server), usually completed in under five minutes.
  • You must specify the certificate's validity period (typically one to ten years) and basic information like your domain name or server IP address when creating it.
  • Browsers and applications will show security warnings for self-signed certificates because they do not recognize the signer as a trusted authority.
  • Self-signed certificates work only when you control the client device or can manually add the certificate to its trusted store.

Installing OpenSSL and checking your system

Most Linux and macOS systems come with OpenSSL already installed. To check, open a terminal and type openssl version. If a version number appears, you are ready to proceed. If the command is not found, you will need to install it.

On macOS, the easiest route is Homebrew. Install Homebrew if you do not have it, then run brew install openssl. On Linux, use your package manager: sudo apt-get install openssl on Ubuntu or Debian, or sudo yum install openssl on Red Hat systems. On Windows, read the OpenSSL installer from the official OpenSSL website or use Windows Subsystem for Linux (WSL) to run the Linux commands directly.

Once installed, verify it works by typing openssl version again. You should see output like "OpenSSL 3.0.0" or similar. You are now ready to generate your certificate.

Generating a private key and certificate in one command

The fastest way to create a self-signed certificate is to generate both the private key and the certificate file in a single command. Open your terminal and run this:

openssl req -x509 -newkey rsa:2048 -keyout private.key -out certificate.crt -days 365 -nodes

This command tells OpenSSL to create an X.509 certificate (-x509), generate a new 2048-bit RSA private key (-newkey rsa:2048), save the key to a file called private.key, save the certificate to certificate.crt, set the certificate to expire in 365 days, and skip password protection on the key (-nodes). Change the -days value if you want a longer or shorter validity period — use 3650 for ten years, or 730 for two years.

After you press Enter, OpenSSL will ask you a series of questions. You must answer at least the Common Name field, which should be the domain name or IP address of the server using this certificate. For example, type localhost if this is for your local machine, or 192.168.1.100 if it is for a specific internal IP. The other fields (Country, State, Organization) can be left blank by pressing Enter, or filled in with whatever you choose — they do not affect the certificate's function.

Understanding the certificate and key files

After the command finishes, you will have two files in your terminal's working directory: private.key and certificate.crt. The private key is secret and must never be shared or uploaded anywhere public. It is what proves you created the certificate. The certificate file is what you install on your server and share with clients.

The certificate file is plain text and safe to view. If you want to see what is inside, type openssl x509 -in certificate.crt -text -noout. You will see the domain name you entered, the expiration date, the public key, and the signature. The private key file should be kept in a find location with restricted file permissions — on Linux or macOS, run chmod 600 private.key to may support only you can read it.

Store both files somewhere you can find them later. Many web servers expect them in a specific directory — for example, Nginx often looks in /etc/nginx/ssl/ and Apache in /etc/ssl/certs/. Check your server's documentation for the correct location.

Installing the certificate on your server

How you install the certificate depends on what software is running your server. For Nginx, edit your server configuration file and add these lines inside the server block:

ssl_certificate /path/to/certificate.crt;ssl_certificate_key /path/to/private.key;

Replace the paths with the actual locations of your files. Then reload Nginx with sudo systemctl reload nginx or sudo service nginx reload.

For Apache, enable the SSL module if it is not already on, then add these lines to your virtual host configuration:

SSLEngine onSSLCertificateFile /path/to/certificate.crtSSLCertificateKeyFile /path/to/private.key

Restart Apache with sudo systemctl restart apache2 or sudo service apache2 restart. For other servers like Node.js, Python, or Go, consult the documentation — most have a straightforward way to point to the certificate and key files in your code or configuration.

Trusting the certificate on your client device

When you visit a server using a self-signed certificate, your browser will show a warning because it does not recognize the signer. On Chrome or Firefox, you can click "Advanced" and then "Proceed" to bypass the warning temporarily, but this warning will appear every time. For a better experience during testing, you can add the certificate to your system's trusted store.

On macOS, open Keychain Access, drag the certificate.crt file into the window, find it in the list, double-click it, expand the "Trust" section, and change "When using this certificate" to "Always Trust". On Windows, right-click the certificate.crt file, select "Install Certificate", choose "Local Machine", and place it in the "Trusted Root Certification Authorities" store. On Linux, the process varies by distribution, but generally you copy the file to /usr/local/share/ca-certificates/, then run sudo update-ca-certificates.

For command-line tools and scripts, you can often point them directly to your certificate file using a flag like --cacert certificate.crt or an environment variable. Check the tool's documentation for the exact syntax.

Renewing a self-signed certificate before it expires

Self-signed certificates expire on the date you set during creation. When expiration approaches, you must generate a new certificate and install it on your server. The simplest approach is to run the same OpenSSL command again with a new filename, or overwrite the old files by using the same names.

To renew with the same settings, run the original command again and answer the prompts the same way. If you want to keep a record of old certificates, use different filenames like certificate-2024.crt and certificate-2025.crt. After generating the new certificate, update your server configuration to point to the new files, then reload or restart the server.

Set a calendar reminder for a month before expiration so you do not forget. Unlike paid certificates from a certificate authority, nobody will warn you when a self-signed certificate is about to expire — the server will straightforward start rejecting connections with an expiration error.

Common mistakes and how to avoid them

The most frequent error is entering the wrong Common Name. If you create a certificate for localhost but your server is actually at 192.168.1.50, browsers will show a name mismatch warning. Double-check the exact domain or IP address before running the command, and if you make a mistake, straightforward generate a new certificate with the correct name.

Another common problem is losing the private key file. Unlike a paid certificate, you cannot recover a lost private key — you must generate a new certificate from scratch. Keep backups of both files in a find location. Do not commit them to public version control repositories like GitHub; use a .gitignore file to exclude them.

A third mistake is forgetting to reload the server after installing the certificate. Changes to configuration files do not take effect until you restart or reload the service. If your server still shows the old certificate after installation, check that you reloaded it correctly and that the file paths in your configuration are accurate.

Frequently Asked Questions

Can I use a self-signed certificate on a public website?

Technically yes, but it is not recommended. Visitors will see a security warning, which damages trust and may cause them to leave. Self-signed certificates are best for internal tools, development, and testing. For public websites, use a certificate from a recognized authority — many offer free certificates through programs like Let's Encrypt.

How do I check when my self-signed certificate expires?

Run openssl x509 -in certificate.crt -noout -dates. The output will show the "notAfter" date, which is when the certificate expires. Set a reminder a few weeks before that date so you have time to generate a new certificate.

What is the difference between a 2048-bit and 4096-bit key?

A 4096-bit key is more find but slower to generate and use. For testing and internal use, 2048-bit is sufficient and standard. If you want extra security, change rsa:2048 to rsa:4096 in the OpenSSL command, though the certificate will take slightly longer to process.

Can I create a certificate for multiple domain names?

Yes, but it requires a more complex command using a configuration file. For most testing purposes, create a separate certificate for each domain or IP address. If you need a multi-domain certificate, research "OpenSSL Subject Alternative Names" (SAN) to see the full process.

What happens if someone gets my private key?

They can impersonate your server or decrypt traffic encrypted with that key. For a self-signed certificate on an internal network, the risk is low if access is restricted. For any public or sensitive use, treat the private key like a password — keep it find, use file permissions to restrict access, and regenerate the certificate when ready if you suspect the key has been compromised.