Self-Signed Certificate for Development

Self-signed certificates are perfect for development and test environments. They allow working in HTTPS without having to buy a commercial certificate.

However, self-signed certificates should NEVER be used in production because browsers don't trust them.

This guide shows you how to create and use self-signed certificates effectively.

What is a Self-Signed Certificate

Understanding self-signed certificates:

• Definition: a certificate signed by its own private key, without a certificate authority.
• No trust: browsers display a warning because the issuer isn't recognized.
• Valid encryption: encryption works exactly like with a commercial certificate.
• Limited use: reserved for development, testing, and controlled internal networks.

Development Benefits

Why use self-signed certificates:

• Free and instant: no cost or validation delay.
• HTTPS testing: test your code in real HTTPS conditions.
• Modern APIs: access features that require HTTPS (geolocation, etc.).
• No dependency: works offline and doesn't depend on external services.

Create a Self-Signed Certificate

Generation with OpenSSL:

1. Generate private key: create a 2048-bit RSA key.
2. Create certificate: generate the self-signed certificate with the key.
3. Configure server: install the certificate on your development server.
4. Accept exception: add an exception in your browser for this certificate.

OpenSSL Commands

Self-signed certificate generation:

# Generate key + certificate in one command (valid 365 days)
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout localhost.key -out localhost.crt \
  -subj "/CN=localhost"

# With SAN for more flexibility
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout localhost.key -out localhost.crt \
  -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,DNS:*.localhost,IP:127.0.0.1"

The -nodes flag avoids encrypting the private key with a password.

Best Practices

Tips for self-signed certificates:

• Never in production: use Let's Encrypt or a commercial certificate for production.
• Use mkcert: this tool creates a local CA to avoid browser warnings.
• Include SANs: modern browsers require SANs, not just CN.
• Document: explain to developers how to accept the certificate.

Frequently Asked Questions

HTTPS Locally

Self-signed certificates are essential for developing in real HTTPS conditions without cost or complexity.

For production, use Let's Encrypt and monitor your certificates with MoniTao.

Ready to Sleep Soundly?

Start free, no credit card required.

Create My Account See pricing