Keys are generated by your browser's WebCrypto and never leave this page — no key, certificate, common name or SAN value is ever transmitted. Works offline; disconnect the network and try it.
Subject Alternative Names
Self-signed certs, CSRs and a browser-based local CA — private keys never leave your machine.
Your files never leave your browser — all processing is local.
Keys are generated by your browser's WebCrypto and never leave this page — no key, certificate, common name or SAN value is ever transmitted. Works offline; disconnect the network and try it.
Fill in a common name, add SANs (domains and IPs), pick a key type (RSA 2048/4096 or ECDSA P-256) and a validity period, and download a ready-to-use PEM certificate and private key. The keys are generated by your browser's WebCrypto — cryptographically equivalent to what openssl produces — and never leave your device, which is the whole problem with pasting into other online generators solved by architecture.
The local CA mode is a browser-based take on the mkcert workflow, and the reason this tool exists: generate a personal CA once, import it into your system trust store (guided steps included), then sign certificates for localhost and internal dev domains with it — and the browser certificate warnings disappear for every cert it signs. Download the CA key to keep it, and drop it back in next time to keep issuing from the same CA — continuity without any server.
A CSR generator covers the real-CA workflow too: key pair + certificate signing request, ready to submit to your certificate authority. Every download comes with the matching nginx, Apache and Node.js configuration snippets, so the cert goes from generated to serving in one paste.
When you need a single importable file rather than separate PEMs, bundle the certificate and its key into a password-protected PKCS#12 (.p12/.pfx) — the format Windows, macOS Keychain, Java keytool and load balancers expect. Every self-signed and local-CA result offers a one-click bundle (the CA chain is included automatically), or paste your own PEM cert and key. Bundling uses modern AES-256-CBC (PBES2 + PBKDF2) with a SHA-256 integrity MAC by default, with a 3DES option for older importers, and works identically for RSA and ECDSA keys — all packed in your browser, nothing uploaded.
Same workflow — create a local CA, trust it once, issue certs for dev domains — but with nothing to install: key generation and X.509 signing run on WebCrypto in your browser. mkcert automates the trust-store import; here you follow a short guided step for your OS instead.
Keys are generated by your browser's WebCrypto API in this tab's memory and are only written to disk when you click download. Nothing is transmitted — the page works with the network disconnected, which you're welcome to verify.
A plain self-signed certificate isn't signed by anything your system trusts, so warnings are expected. That's what the local CA mode fixes: trust your personal CA once, and every certificate it signs — localhost, *.test domains, LAN IPs — is accepted without warnings.
ECDSA P-256 for development: smaller, faster, universally supported by modern stacks. RSA 2048 if some legacy component in your setup requires it; RSA 4096 only when a policy demands it (it's noticeably slower).
No — production needs certificates from a publicly trusted CA (Let's Encrypt is free). Self-signed and local-CA certificates are for development, testing and internal tooling, where they're exactly the right tool.
Yes. After generating (or by pasting your own PEM cert and key), set a password and download a PKCS#12 bundle — the format Windows, macOS Keychain, Java keytool and most load balancers import. The default is modern AES-256-CBC (PBES2 + PBKDF2) with a SHA-256 integrity MAC; a 3DES option covers older importers. Local-CA leaves bundle their CA chain automatically. The private key is packed in your browser and only touches disk on download.
Yes — RSA and ECDSA (EC) keys bundle identically. The key is handled as opaque PKCS#8 bytes when packing, so there's no RSA-only limitation; the resulting .p12 imports into OpenSSL, Windows, Keychain and keytool the same way.