SSL Glance.me

X.509 · localhost · dev servers

Self-signed certificate generator

Make a certificate and private key for local development and test servers, with host names and IP addresses, right in your browser. Then trust it on your own machine so the warning goes away.

Certificate details

For development only

Not for public websites. Only machines where you trust this certificate accept it; every other visitor gets a full-page warning. Public sites need a certificate from a CA such as Let’s Encrypt.

Apple devices reject TLS certificates valid for more than 825 days.
Every name or address you will type in the browser, such as myapp.test or 192.168.1.20. One per line; the common name is included automatically.
Key type
Key created in your browser

Same thing with OpenSSL

openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -sha256 -days 365

Trust it on your machine

Removes the browser warning locally

Add the certificate to the trust store of the computer you develop on, then restart the browser. Replace localhost.crt with your file name.

macOS (Safari, Chrome, Edge)

Double-click the file to add it to Keychain Access, open it, expand Trust and set “When using this certificate” to Always Trust. Or in Terminal:

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain localhost.crt
Windows (Chrome, Edge)

Double-click the file, choose Install Certificate → Local Machine → Trusted Root Certification Authorities. Or in an administrator terminal:

certutil -addstore -f Root localhost.crt
Linux (system tools, curl)

Debian and Ubuntu:

sudo cp localhost.crt /usr/local/share/ca-certificates/localhost.crt && sudo update-ca-certificates

Fedora and RHEL:

sudo cp localhost.crt /etc/pki/ca-trust/source/anchors/ && sudo update-ca-trust

Chrome and Chromium on Linux use their own NSS database (install libnss3-tools first):

certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n localhost -i localhost.crt
Firefox

Firefox keeps its own list. Open your dev site once, choose Advanced → Accept the Risk and Continue, and Firefox remembers the exception for this certificate.

Node.js and other clients

Point the client at the certificate, for example:

NODE_EXTRA_CA_CERTS=./localhost.crt node client.js
curl --cacert localhost.crt https://localhost:8443/

If a browser still refuses the certificate, check that the address you open is one of its names. Some setups work better with a local CA; tools such as mkcert create one for you.

How to use it

  1. List every host name and IP address your dev server answers on. The browser checks the exact address you open against these names; *.myapp.test covers one level of subdomains.
  2. Pick a validity and key type, then select Generate certificate.
  3. Download the certificate and key and point your dev server at them, for example https.createServer({ key, cert }) in Node.js or ssl_certificate and ssl_certificate_key in nginx.
  4. Trust the certificate on your machine (steps above) and restart the browser.

The certificate is marked for TLS server authentication only and cannot act as a CA. Inspect it at any time with the certificate decoder.

Frequently asked questions

Why does the browser still show a warning?

A self-signed certificate is trusted only on machines where you added it to the trust store. Check that the address you open is one of the certificate’s names, restart the browser after trusting it, and make sure it has not expired.

How long should it be valid?

A year is a sensible default. Apple platforms reject TLS certificates valid for more than 825 days, so stay below that if you test on a Mac, iPhone or iPad.

Can I use it on a public website?

No. Visitors’ browsers do not trust it and show a full-page warning. Use a free certificate from a public CA such as Let’s Encrypt for anything others will open.