DevTransformFREE
Zero-Upload • 100% Client-Side
OpenSSL • Generation & Keys

How to Generate a Self-Signed SSL Certificate with OpenSSL

A self-signed certificate encrypts traffic between client and server without requiring validation from a public Certificate Authority (CA). The `-nodes` flag generates an unencrypted private key suitable for automated daemon restarts in NGINX, Apache, or Node.js.

Generate Self-Signed Certificate Command
Safe • Read-Only / File Generation
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -nodes -subj "/CN=localhost"
Customize:
Domain:
Cert File:

OpenSSL Flags & Options Explained

-x509Outputs a self-signed X.509 certificate instead of a certificate signing request (CSR)
-newkey rsa:4096Generates a new 4096-bit RSA private key simultaneously
-keyout key.pemOutput destination file for the private key
-out cert.pemOutput destination file for the public certificate
-sha256Uses SHA-256 hashing algorithm instead of insecure SHA-1
-days 365Certificate validity duration in days
-nodesNo DES encryption on private key (prevents password prompt on server restart)
-subj "/CN=localhost"Subject string providing Common Name to avoid interactive wizard prompts

Execution Steps & Verification

1Run one-line generation command

Generate both the private key and public certificate in a single non-interactive command:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -nodes -subj "/CN=localhost"
2Verify generated files

Confirm key.pem and cert.pem were created and verify permissions:

chmod 600 key.pem && ls -lh cert.pem key.pem
3Inspect certificate expiry

Check valid dates to confirm the 365-day lifetime:

openssl x509 -in cert.pem -noout -dates

Common Security Pitfalls & Solutions

  • Browsers like Chrome will show NET::ERR_CERT_AUTHORITY_INVALID because the certificate is self-signed. You can add it to your OS trust store or use mkcert for local CA trust.
  • Always set private key file permissions to 600 (`chmod 600 key.pem`) so other users on the system cannot read your key.

Prerequisites & Environment

  • OpenSSL 1.1.1 or 3.x installed on your system.
  • Terminal with write permissions to the working directory.

Frequently Asked Questions About Generate Self-Signed Certificate

Frequently Asked Questions

Frequently Asked Questions

Everything you need to know regarding specifications, syntax, and security best practices.

It stands for "No DES". It tells OpenSSL not to encrypt the private key with a passphrase, allowing web servers like NGINX or Caddy to boot without human intervention.

Related OpenSSL & Security Commands

View All Recipes
Verification & Inspection

How to Check SSL Certificate Expiration Date from Domain or File

s_clientGuide →
Verification & Inspection

How to View and Inspect SSL Certificate Details (Subject, Issuer, SAN)

x509Guide →
Verification & Inspection

How to Verify Private Key Matches SSL Certificate (Modulus MD5 Check)

x509Guide →
Generation & Keys

How to Generate a Certificate Signing Request (CSR) with SAN

reqGuide →
Format Conversions

How to Convert PFX / PKCS#12 to PEM Certificate and Private Key

pkcs12Guide →
Format Conversions

How to Convert CRT, CER or DER to PEM Format

x509Guide →