Generating a Self-Signed SSL Certificate on Windows and Linux: Complete Setup, Security, and Best Practices

• A self-signed SSL certificate is signed by its own private key, not by a trusted Certificate Authority. It provides full encryption but triggers browser trust warnings because there is no external validation of identity.
• Modern browsers require Subject Alternative Names (SAN) . A certificate without SAN will generate a NET::ERR_CERT_COMMON_NAME_INVALID error regardless of the Common Name field.
• mkcert is the recommended tool for local development, creating locally-trusted certificates without browser warnings. OpenSSL remains the standard for custom or automated certificate generation.
• Private keys must be protected with strict permissions (chmod 600) and should never be committed to version control. Use RSA 4096 or ECDSA for cryptographic strength.
• Production environments must use publicly trusted certificates from Let’s Encrypt or a commercial CA. Self-signed certificates are appropriate only for development, testing, and internal services.

• Local development environments (localhost, 127.0.0.1)
• Docker containers and container orchestration (Kubernetes, Docker Compose)
• Internal APIs that are not exposed to the public internet
• Home labs and personal projects
• Development microservices
• IoT devices (Raspberry Pi, embedded systems)
• Internal dashboards and monitoring tools
• Staging environments where public trust is not required

• Public e‑commerce websites
• Customer‑facing portals
• Any service that handles sensitive user data over the public internet
• API endpoints consumed by third parties

sudo apt update
sudo apt install openssl

sudo dnf install openssl

sudo pacman -S openssl

openssl version

choco install openssl

scoop install openssl

openssl version

# Ubuntu / Debian
sudo apt update && sudo apt install openssl
# Fedora / RHEL / Rocky / AlmaLinux
sudo dnf install openssl
# Arch Linux
sudo pacman -S openssl

openssl x509 -inform der -in certificate.cer -out certificate.pem

openssl pkcs12 -in certkey.pfx -out certkey.pem -nodes

openssl pkcs12 -export -in server.crt -inkey server.key -out server.pfx

openssl req -x509 -newkey rsa:2048 -keyout server.key -out server.crt -days 365 -nodes

[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[dn]
C = SK
ST = Bratislavský kraj
L = Bratislava
O = My Company
OU = Engineering
CN = localhost

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = *.localhost
DNS.3 = myapp.local
IP.1 = 127.0.0.1
IP.2 = ::1

openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days 365 -sha256 -config san.cnf -extensions req_ext

openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days 365 -sha256 -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,DNS:*.localhost,IP:127.0.0.1"

[alt_names]
DNS.1 = example.com
DNS.2 = www.example.com
DNS.3 = api.example.com
DNS.4 = *.example.com
IP.1 = 192.168.1.10
IP.2 = 10.0.0.5

• DNS.1 = localhost
• DNS.2 = *.localhost (if using .localhost domains)
• IP.1 = 127.0.0.1
• IP.2 = ::1

1. Double‑click the .crt file
2. Click Install Certificate
3. Select Local Machine
4. Choose Place all certificates in the following store
5. Browse and select Trusted Root Certification Authorities
6. Click OK → Finish

sudo cp server.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

sudo cp server.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain server.crt

• Settings → Privacy & Security → Certificates → View Certificates → Import

sudo a2enmod ssl
sudo a2enmod headers # for HSTS
sudo systemctl restart apache2

<VirtualHost *:443>
 ServerName localhost
 DocumentRoot /var/www/html
 SSLEngine on
 SSLCertificateFile /etc/ssl/certs/server.crt
 SSLCertificateKeyFile /etc/ssl/private/server.key
 # Modern TLS settings
 SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
 SSLHonorCipherOrder off
 # HSTS
 Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
 # OCSP Stapling
 SSLUseStapling on
 SSLStaplingCache shmcb:/var/run/ocsp(128000)
</VirtualHost>

<VirtualHost *:80>
 ServerName localhost
 Redirect permanent / https://localhost/
</VirtualHost>

sudo a2enmod http2

Protocols h2 http/1.1

server {
 listen 443 ssl http2;
 listen [::]:443 ssl http2;
 server_name localhost;
 ssl_certificate /etc/ssl/certs/server.crt;
 ssl_certificate_key /etc/ssl/private/server.key;
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
 ssl_prefer_server_ciphers off;
 add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
 root /var/www/html;
 index index.html;
}

server {
 listen 80;
 listen [::]:80;
 server_name localhost;
 return 301 https://$server_name$request_uri;
}

listen 443 quic reuseport;
add_header Alt-Svc 'h3=":443"; ma=86400';

1. Open IIS Manager
2. Select the server node → Server Certificates
3. Click Import and select the PFX file
4. Bind the certificate to the website:
   • Select the site → Bindings → Add → https
   • Select the certificate from the dropdown
   • Enable Require Server Name Indication (SNI)

localhost {
 tls internal
 root * /var/www/html
 file_server
}

const https = require('https');
const fs = require('fs');
const options = {
 key: fs.readFileSync('server.key'),
 cert: fs.readFileSync('server.crt')
};
https.createServer(options, (req, res) => {
 res.writeHead(200);
 res.end('Hello HTTPS!');
}).listen(443);

const express = require('express');
const https = require('https');
const fs = require('fs');
const app = express();
const options = {
 key: fs.readFileSync('server.key'),
 cert: fs.readFileSync('server.crt')
};
https.createServer(options, app).listen(443);

php artisan serve --port=443 --host=localhost --ssl-key=server.key --ssl-cert=server.crt

symfony server:start --port=443 --ssl-key=server.key --ssl-cert=server.crt

php -S localhost:443 -t . --ssl-key=server.key --ssl-cert=server.crt

FROM alpine:latest
RUN apk add --no-cache openssl
RUN openssl req -x509 -newkey rsa:4096 -keyout /certs/server.key -out /certs/server.crt -days 365 -nodes -subj "/CN=localhost"

version: '3'
services:
 nginx:
 image: nginx:alpine
 volumes:
 - ./nginx.conf:/etc/nginx/conf.d/default.conf
 - ./certs:/etc/ssl/certs
 ports:
 - "443:443"

kubectl create secret tls tls-secret --key server.key --cert server.crt

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
 name: example-ingress
spec:
 tls:
 - hosts:
 - example.local
 secretName: tls-secret
 rules:
 - host: example.local
 http:
 paths:
 - path: /
 pathType: Prefix
 backend:
 service:
 name: example-service
 port:
 number: 80

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
 name: selfsigned-issuer
spec:
 selfSigned: {}

# Install mkcert
brew install mkcert # macOS
choco install mkcert # Windows
sudo apt install mkcert # Linux
# Install local CA
mkcert -install
# Generate certificate
mkcert localhost 127.0.0.1 ::1 *.localhost myapp.local

• Chrome: Click the padlock → Connection is secure → Certificate is valid
• Firefox: Click the padlock → Connection secure → More information → View Certificate

# View certificate details
openssl x509 -in server.crt -text -noout
# Verify certificate against CA
openssl verify -CAfile ca.crt server.crt
# Check SSL connection
openssl s_client -connect localhost:443 -servername localhost

curl -v https://localhost --cacert server.crt

./testssl.sh https://localhost

• File permissions: chmod 600 server.key
• Never commit private keys to version control
• Use password‑protected keys where appropriate: bashopenssl genrsa -aes256 -out server.key 4096

• Issue certificates with a validity period of 365 days or less
• Automate rotation using scripts or cron jobs
• For production, use Let’s Encrypt with 90‑day certificates

• Avoid SHA‑1: Use -sha256 or -sha384
• Avoid RSA < 2048 bits
• Prefer ECDSA over RSA where possible

• Disable TLS 1.0 and TLS 1.1
• Enable TLS 1.2 and TLS 1.3 only

TLSv1.2
TLSv1.3

TLS_AES_256_GCM_SHA384
TLS_AES_128_GCM_SHA256
TLS_CHACHA20_POLY1305_SHA256

ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-GCM-SHA384

• Enable Perfect Forward Secrecy (PFS) – all modern ciphers support it
• Enable OCSP Stapling for certificate revocation checking
• Enable HSTS to enforce HTTPS
• Disable compression (CRIME attack)
• Enable session resumption for performance

#!/bin/bash
openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days 365 -nodes -config san.cnf -extensions req_ext
sudo systemctl reload nginx

0 2 1 * * /usr/local/bin/renew-cert.sh

[Timer]
OnCalendar=monthly
Persistent=true

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

• Obtain certificate from trusted CA
• Deploy certificate with zero downtime (use staging environment)
• Update load balancers and CDN configurations
• Update internal services and API clients
• Update monitoring and alerting
• Test thoroughly before switching production traffic
• Set up automated renewal

• OpenSSL – standard tool for custom certificates
• mkcert – default for local development to avoid browser warnings

• Apache HTTP Server – for legacy and PHP applications
• Nginx – for modern web applications and reverse proxying
• Caddy – for automatic HTTPS and zero‑config setups

• Docker & Docker Compose – containerised development environments
• WSL – seamless Linux development on Windows
• Git Bash – OpenSSL on Windows without installation

• curl – basic connection testing
• OpenSSL s_client – detailed TLS inspection
• testssl.sh – comprehensive TLS/SSL scanning

• SSL Labs – public server security grading
• testssl.sh – internal server security auditing

• Local development and testing
• Internal services and APIs
• Containerised and orchestrated environments
• IoT and embedded systems

• Always include Subject Alternative Names
• Use RSA 4096 or ECDSA
• Apply modern TLS settings (TLS 1.2/1.3 only)
• Protect private keys with strict permissions
• Rotate certificates regularly
• Use mkcert for local development to avoid browser warnings

• Any production service exposed to external users
• Services handling sensitive user data
• Public e‑commerce or business websites