ByteScope

Certificate Generator

Self-signed certs, CSRs and a browser-based local CA — private keys never leave your machine.

Your files never leave your browser — all processing is local.

Keys are generated by your browser's WebCrypto and never leave this page — no key, certificate, common name or SAN value is ever transmitted. Works offline; disconnect the network and try it.

Subject Alternative Names
Key algorithm

About this tool

Fill in a common name, add SANs (domains and IPs), pick a key type (RSA 2048/4096 or ECDSA P-256) and a validity period, and download a ready-to-use PEM certificate and private key. The keys are generated by your browser's WebCrypto — cryptographically equivalent to what openssl produces — and never leave your device, which is the whole problem with pasting into other online generators solved by architecture.

The local CA mode is a browser-based take on the mkcert workflow, and the reason this tool exists: generate a personal CA once, import it into your system trust store (guided steps included), then sign certificates for localhost and internal dev domains with it — and the browser certificate warnings disappear for every cert it signs. Download the CA key to keep it, and drop it back in next time to keep issuing from the same CA — continuity without any server.

A CSR generator covers the real-CA workflow too: key pair + certificate signing request, ready to submit to your certificate authority. Every download comes with the matching nginx, Apache and Node.js configuration snippets, so the cert goes from generated to serving in one paste.

Frequently asked questions

How is this different from mkcert?
Same workflow — create a local CA, trust it once, issue certs for dev domains — but with nothing to install: key generation and X.509 signing run on WebCrypto in your browser. mkcert automates the trust-store import; here you follow a short guided step for your OS instead.
Where is the private key generated, and does it leave my machine?
Keys are generated by your browser's WebCrypto API in this tab's memory and are only written to disk when you click download. Nothing is transmitted — the page works with the network disconnected, which you're welcome to verify.
Why does my browser still warn about my self-signed certificate?
A plain self-signed certificate isn't signed by anything your system trusts, so warnings are expected. That's what the local CA mode fixes: trust your personal CA once, and every certificate it signs — localhost, *.test domains, LAN IPs — is accepted without warnings.
Should I use RSA or ECDSA?
ECDSA P-256 for development: smaller, faster, universally supported by modern stacks. RSA 2048 if some legacy component in your setup requires it; RSA 4096 only when a policy demands it (it's noticeably slower).
Can I use these certificates in production?
No — production needs certificates from a publicly trusted CA (Let's Encrypt is free). Self-signed and local-CA certificates are for development, testing and internal tooling, where they're exactly the right tool.