What Is a Self-Signed SSL Certificate and How to Create One
-
A self-signed certificate encrypts traffic just like a regular SSL certificate, but no certificate authority vouches for it, so browsers don't trust it. Here's when it's fine to use one, the risks, and how to create one correctly.
- Automatic renewals
- Less manual work
-
-
*
What Is a Self-Signed Certificate?
A regular SSL certificate is signed by a certificate authority (CA). The browser follows the chain from your certificate through the CA's intermediate certificate to a root certificate it already trusts. A self-signed certificate is signed with its own private key, so there's no chain to follow and no independent party confirming who owns it.
Root certificates of CAs are technically self-signed as well. The difference is that browsers and operating systems ship with those roots preinstalled. Your self-signed certificate isn't on that list, so visitors see a warning such as NET::ERR_CERT_AUTHORITY_INVALID.
-
*
When to Use One, and When Not To
Self-signed certificates are fine where only you or your team connect and you control the devices:
- Local development and testing, such as running a site on localhost over HTTPS
- Lab setups and short-lived test servers
- Closed internal systems with a handful of devices
Don't use them for anything the public or your customers access, including websites, online stores, APIs used by partners, and email servers. Anything that faces the internet needs a certificate from a trusted CA. A DV certificate is issued within minutes.
-
*
The Risks
- Warnings train users to click through. The encryption itself is just as strong, but the browser can't confirm who's on the other end. People who get used to clicking "Proceed anyway" won't notice when an attacker presents a fake certificate.
- No revocation. If the private key leaks, there's no way to revoke the certificate. You have to remove it from every device that trusts it.
- Everything is manual. Every device needs the certificate installed by hand, and nobody reminds you when it expires.
-
*
How to Create a Self-Signed Certificate
With OpenSSL, one command creates both the private key and the certificate:
openssl req -x509 -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.crt -days 365 -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"- -x509 creates a certificate instead of a CSR.
- -newkey rsa:2048 -nodes generates a new 2048-bit RSA key without a password, so the web server can read it on startup.
- -days 365 makes the certificate valid for one year.
- -addext "subjectAltName=…" lists the names the certificate is valid for. Replace localhost and 127.0.0.1 with your own host names or IP addresses.
Important: Always include the subjectAltName part. Modern browsers check the host name only in this field. Without it, the certificate fails with NET::ERR_CERT_COMMON_NAME_INVALID even after you trust it. The -addext option requires OpenSSL 1.1.1 or later.
Then configure your web server to use localhost.crt as the certificate and localhost.key as the private key.
-
*
How to Make Your Computer Trust It
To stop the warnings on your own computer, add the certificate to the operating system's trusted root store:
- Windows: open certlm.msc, right-click Trusted Root Certification Authorities > Certificates, and choose All Tasks > Import.
- macOS: open the certificate in Keychain Access, add it to the System keychain, and set When using this certificate to Always Trust.
- Ubuntu and Debian: copy the file to /usr/local/share/ca-certificates/ and run sudo update-ca-certificates.
Firefox uses its own certificate store by default, so you may need to import the certificate there separately under Settings > Privacy & Security > View Certificates.
Tip: Only add self-signed certificates to devices you manage yourself. Never ask website visitors or customers to install one. That would teach them to trust certificates nobody has verified.
-
*
Alternatives to Self-Signed Certificates
- A certificate from a CA for anything that faces the internet. Browsers trust it automatically, and it can be renewed and revoked.
- A private CA if your organization needs many internal certificates. Instead of trusting each certificate separately, devices trust one internal root, and certificates can be issued, renewed, and revoked centrally. GoGetSSL offers managed private CA solutions.
-
