Skip to main content
Certificate issuance

Self-signed Certificates for Development and Testing

Create and configure self-signed certificates for local development and test environments.

CertOne2 min read

Self-signed certificates can enable TLS in controlled development and test environments without public CA issuance. This guide explains how to create and use them.

1. What is a self-signed certificate?​

1. Definition​

A self-signed certificate is signed with its own private key rather than by an external CA. Trust must be configured explicitly.

2. Characteristics​

  • Free
  • Quick to generate
  • Not trusted by browsers by default
  • Suited to controlled local or test environments

2. Create a certificate​

1. OpenSSL​

# Generate a private key.
openssl genrsa -out private.key 2048

# Generate a certificate signing request.
openssl req -new -key private.key -out certificate.csr

# Create a self-signed certificate.
openssl x509 -req -days 365 -in certificate.csr -signkey private.key -out certificate.crt

2. mkcert​

# Install mkcert.
brew install mkcert  # macOS
# Or download the binary for your platform.

# Install the local CA.
mkcert -install

# Generate a certificate.
mkcert localhost 127.0.0.1 ::1

3. Configure the server​

1. NGINX configuration​

server {
    listen 443 ssl;
    server_name localhost;
    
    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/private.key;
    
    # Add the remaining site configuration here.
}

2. Apache configuration​

<VirtualHost *:443>
    ServerName localhost
    SSLEngine on
    SSLCertificateFile /path/to/certificate.crt
    SSLCertificateKeyFile /path/to/private.key
    # Add the remaining site configuration here.
</VirtualHost>

Browser trust​

1. Configure local trust​

Chrome/Edge：

  • Open the browser's certificate information
  • Open the certificate viewer
  • Select the certificate installation option
  • Choose the intended trusted-root store for your controlled development environment

Firefox：

  • Open the browser's certificate information
  • Open Connection secure → More information
  • Open the certificate manager and use its import option

Safari：

  • Double-click the certificate file
  • Add it to the System keychain if appropriate
  • Set the intended development certificate's trust policy

Considerations​

1. Browser warnings​

  • A self-signed certificate produces warnings until trusted
  • Configure trust explicitly on the intended clients
  • Suited to controlled local or test environments

2. Production​

  • Do not use an untrusted self-signed certificate for a public production website
  • Use a certificate from a trusted CA
  • CertOne provides free Let's Encrypt issuance

Best practices​

1. Local development​

  • ✅ Use mkcert for local certificates
  • ✅ Install the local CA in the intended trust stores
  • ✅ Include localhost in the certificate names

2. Test environments​

  • ✅ Use explicitly trusted local certificates where appropriate
  • ✅ Or use a public certificate, such as Let's Encrypt, for a domain you control
  • ✅ Configure automatic renewal

Conclusion​

Self-signed certificates are easy to create but require explicit client trust. Use publicly trusted certificates for public production sites.