Online Self-Signed X.509 Certificate and RSA Key Generator

Generate an RSA key pair and a self-signed X.509 certificate for local development, integration testing, mTLS experiments and software configuration. Download certificate and key material in common PEM, DER, PFX/P12 and JWK-compatible formats.

Self-signed certificates are suitable for controlled testing but are not automatically trusted by browsers or operating systems. Public production services normally require a certificate issued by a trusted certificate authority.

Instructions

This tool generates an RSA key pair and a self-signed X.509 certificate directly in the browser, without sending data or keys to external servers. After generation, the certificate and keys can be downloaded in the most common formats.

Important: the generated certificate is self-signed. It is suitable for development, testing, internal networks and learning, but browsers do not automatically recognize it as a trusted public certificate.

How to generate the certificate

Generate Randomly

Asks which profile you want and then generates immediately with fictional data, without any form to fill in. Standard X.509 produces a self-signed certificate with 365-day validity and a 2048-bit RSA key. e-CNPJ (ICP-Brasil) produces the Brazilian legal entity profile with a randomly generated valid CNPJ. The Alphanumeric CNPJ switch in that dialog decides which CNPJ format is drawn.

Fill Manually

Opens the customization form. Fill in the desired data and click Generate Certificate. The Common Name (CN) is required; the other identity fields are optional. You can also set the validity and choose a 2048- or 4096-bit RSA key.

e-CNPJ (ICP-Brasil)

Opens a form that follows the Brazilian e-CNPJ profile instead of the generic X.509 one. It is pre-filled with a randomly generated valid CNPJ, so you can generate immediately, edit any field, or press the dice button next to a field to re-randomize only that value. The CNPJ, the Registration Authority CNPJ and the responsible person CPF are validated by their check digits before generation is allowed.

About the e-CNPJ profile

An e-CNPJ identifies a Brazilian legal entity and is normally issued by a Certification Authority accredited by ICP-Brasil. This tool reproduces the certificate structure described in the Receita Federal layout so that applications which read those fields — NF-e and NFC-e issuers, e-Social, SPED, banking integrations and government web services — can be tested without a real certificate.

Test material only: the generated e-CNPJ is self-signed and has no ICP-Brasil chain behind it. It reproduces the field layout, not the trust. Government and banking production services will reject it, and the CNPJ produced by the dice button is a random number with valid check digits, not a real company.

Distinguished Name

The subject is assembled as CN=<business name>:<CNPJ>, followed by the Organizational Units carrying the Registration Authority CNPJ, the identification type, the certificate type (RFB e-CNPJ A1 and similar) and the fixed unit Secretaria da Receita Federal do Brasil - RFB. City and state go into L and ST, with O=ICP-Brasil and C=BR. Accents are removed and the business name is truncated to 49 characters, as the layout requires.

Subject Alternative Name

The identity data is written as otherName entries inside the subjectAltName extension, which is where Brazilian applications look for it:

2.16.76.1.3.2 — name of the person responsible for the legal entity;
2.16.76.1.3.3 — the CNPJ, 14 characters;
2.16.76.1.3.4 — responsible person data at fixed positions: 8 for the birth date in ddmmyyyy, 11 for the CPF, 11 for the NIS, 15 for the RG and the remaining positions for the RG issuer and state;
2.16.76.1.3.7 — the CEI, 12 positions;
rfc822Name — the e-mail of the responsible person.

Fields that are unavailable are filled entirely with zeros, and the issuer/state pair is omitted when there is no RG, matching the specification. Only A-Z and 0-9 reach these fields, so accents and punctuation are stripped automatically.

Extensions

Key Usage is marked critical with digitalSignature, nonRepudiation and keyEncipherment. Extended Key Usage carries client authentication (1.3.6.1.5.5.7.3.2) and e-mail protection (1.3.6.1.5.5.7.3.4). Basic Constraints marks an end entity, and Certificate Policies carries the ICP-Brasil arc matching the chosen type, which you can override with your own policy OID.

Alphanumeric CNPJ

The Alphanumeric CNPJ switch generates identifiers in the format adopted by the Receita Federal in which the first twelve positions may contain letters. The check digits are computed with the same weighted rule, using each character's ASCII code minus 48, so the two formats share one algorithm and both are validated in the form.

Manual form fields

Common Name (CN) *

Required field that identifies the certificate holder. For a server, this is usually the domain or host name, such as api.example.com. In this tool, the CN is also included as an alternative DNS name in the certificate.

Organization (O)

Name of the company or organization responsible for the certificate. Example: Example Inc.

Organizational Unit (OU)

Sector or department inside the organization. Example: Information Technology.

Country (C)

Two-letter country code according to ISO 3166-1. Example: BR for Brazil, US for United States.

State (ST)

Name of the state or province. Example: California.

Locality (L)

City where the organization is located. Example: San Francisco.

Email

Email address associated with the certificate holder. Optional field.

Validity (days)

Defines how many days the certificate will be valid after generation. The tool accepts 1 to 7300 days, with 365 days as the initial value.

Key Size

2048 bits offers good security and faster generation for most tests. 4096 bits creates a larger key, but takes longer to generate and process.

Download buttons and formats

After generation, the download buttons appear next to the certificate data. Each button exports the same certificate or the same key pair in a different representation.

Certificate .pfx and Certificate .p12

These are two extensions for the PKCS#12 binary format. Each file bundles the certificate and private key in a single package, useful for import into Windows/IIS, browsers, Java and other platforms. Both buttons generate the same content, changing only the file extension.

Before downloading, fill in PFX/P12 password to protect these two files. If the field is empty, they are generated without a password.

Certificate .cer

Exports only the public certificate in binary DER format. It does not contain the private key and can be used to distribute the identity and public key to systems that need to validate signatures or trust.

Certificate .pem

Exports only the certificate as Base64 text between the BEGIN CERTIFICATE and END CERTIFICATE markers. It is widely used on Linux servers such as Nginx and Apache, load balancers and APIs.

Public Key .pem

Exports the public part of the RSA key as PEM text. It can be shared to verify signatures or encrypt data intended for the private key holder.

RSA Private Key .pem

Exports the private key in the traditional PKCS#1 format, identified by the BEGIN RSA PRIVATE KEY marker. It is common in OpenSSL-based tools and integrations.

PKCS8 Private Key .pem

Exports the same private key in PKCS#8 format, identified by the BEGIN PRIVATE KEY marker. It is a more generic and interoperable representation, widely accepted by Java, Node.js, Python and other modern libraries.

Public Key .jwk

Exports the public key as a JSON Web Key, a common format in JWT, OAuth 2.0 and OpenID Connect. It can be used by other systems to validate signatures and can be part of a public JWKS set.

Private Key .jwk

Exports all private RSA key parameters as JSON. Despite the readable format, it is still a private key and must never be published or sent to third parties.

Download All (.zip)

Bundles all formats above into a single ZIP file. The provided password protects only the PFX and P12 files: the ZIP, private PEM files and private JWK are not encrypted by that password.

Protect private keys: anyone who obtains a private key can impersonate the holder, sign data or access information protected by the key pair. Keep private files in a secure location and avoid sharing them.

About the self-signed X.509 certificate

An X.509 certificate associates an identity with a public key. In this tool, the certificate itself is signed by the private key that was just generated, without validation by an external Certificate Authority. Therefore, it can be used when participants configure trust manually, for example in:

development environments and internal tests;
TLS communication between services on a private network;
JWT signing and validation in internal APIs;
mutual authentication (mTLS) between controlled services;
study of certificates, RSA cryptography and public key infrastructure.