Generators

Certificate Generator

Generate a self-signed X.509 certificate for testing, development, or internal infrastructure. Choose RSA (2048, 3072, 4096), ECDSA (P-256, P-384, P-521), or Ed25519 keys. Configure the subject (Common Name, Organization, etc.), validity period, and SANs (Subject Alternative Names). The output includes the certificate in PEM format and the private key.

Certificate Generator — Generate self-signed X.509 certificates with RSA, ECDSA, or Ed25519 keys

What it does

  • ▸Generates self-signed X.509 certificates with RSA, ECDSA, or Ed25519 keys
  • ▸Configurable subject: CN, O, OU, L, ST, C
  • ▸Configurable validity period (days)
  • ▸Supports Subject Alternative Names (SANs) for multiple domains/IPs
  • ▸Outputs certificate and private key in PEM format
  • ▸Uses the Web Crypto API for key generation

Use cases

  • ▸Generating a self-signed certificate for local HTTPS development
  • ▸Creating a test certificate for mTLS (mutual TLS) testing
  • ▸Generating certificates for internal infrastructure or service mesh
  • ▸Testing certificate parsing with the Certificate Decoder tool

How it works

1

Select the key algorithm (RSA, ECDSA, or Ed25519) and key size/curve

2

Fill in the subject fields (Common Name, Organization, etc.)

3

Add SANs if needed (additional domains or IP addresses)

4

Set the validity period and generate

5

Copy the certificate and private key in PEM format

Frequently asked questions

1Are self-signed certificates secure for production?

No. Self-signed certificates are not trusted by browsers or operating systems because they're not signed by a recognized CA. Use them for development, testing, or internal infrastructure where you can distribute the certificate manually. For production, use a CA like Let's Encrypt.

2What are SANs and why do I need them?

Subject Alternative Names let a single certificate cover multiple domains or IP addresses. Modern browsers ignore the Common Name and only check SANs. If your certificate needs to work for example.com and www.example.com, add both as SANs.

3What key type should I choose?

RSA 2048 is the most compatible and widely used. ECDSA P-256 is faster and produces smaller certificates. Ed25519 is the fastest and most modern but has less tooling support. For development, RSA 2048 is the safe default.

Related tools

Certificate Decoder (X.509) — Decode a PEM certificate — subject, issuer, validity, SANs, fingerprints

Certificate Decoder (X.509)

Decode a PEM certificate — subject, issuer, validity, SANs, fingerprints

JWT Key Generator — Generate cryptographically secure keys for every JWT algorithm — HMAC, RSA, ECDSA, EdDSA

JWT Key Generator

Generate cryptographically secure keys for every JWT algorithm — HMAC, RSA, ECDSA, EdDSA

JWT Debugger — Decode JWT tokens, inspect claims, verify signatures, and sign new tokens

JWT Debugger

Decode JWT tokens, inspect claims, verify signatures, and sign new tokens

Hash Generator — MD5 / SHA / CRC32 / Blake hashes and HMACs of the input text

Hash Generator

MD5 / SHA / CRC32 / Blake hashes and HMACs of the input text

Use Certificate Generator offline in Devinity

All 95 tools run locally on your Mac. No internet required, no data sent to servers.

Download Devinity →