Online Self-Signed X.509 Certificate and RSA Key Generator

Generate an RSA key pair and a self-signed X.509 certificate for local development, integration testing, mTLS experiments and software configuration. Download certificate and key material in common PEM, DER, PFX/P12 and JWK-compatible formats.

Self-signed certificates are suitable for controlled testing but are not automatically trusted by browsers or operating systems. Public production services normally require a certificate issued by a trusted certificate authority.

Instructions

This tool generates an RSA key pair and a self-signed X.509 certificate directly in the browser, without sending data or keys to external servers. After generation, the certificate and keys can be downloaded in the most common formats.

Important: the generated certificate is self-signed. It is suitable for development, testing, internal networks and learning, but browsers do not automatically recognize it as a trusted public certificate.

How to generate the certificate

Generate Randomly

Generates the certificate immediately with fictional data, 365-day validity and a 2048-bit RSA key. This is the fastest option for tests where identity data does not need to be customized.

Fill Manually

Opens the customization form. Fill in the desired data and click Generate Certificate. The Common Name (CN) is required; the other identity fields are optional. You can also set the validity and choose a 2048- or 4096-bit RSA key.

Manual form fields

Common Name (CN) *

Required field that identifies the certificate holder. For a server, this is usually the domain or host name, such as api.example.com. In this tool, the CN is also included as an alternative DNS name in the certificate.

Organization (O)

Name of the company or organization responsible for the certificate. Example: Example Inc.

Organizational Unit (OU)

Sector or department inside the organization. Example: Information Technology.

Country (C)

Two-letter country code according to ISO 3166-1. Example: BR for Brazil, US for United States.

State (ST)

Name of the state or province. Example: California.

Locality (L)

City where the organization is located. Example: San Francisco.

Email

Email address associated with the certificate holder. Optional field.

Validity (days)

Defines how many days the certificate will be valid after generation. The tool accepts 1 to 7300 days, with 365 days as the initial value.

Key Size

2048 bits offers good security and faster generation for most tests. 4096 bits creates a larger key, but takes longer to generate and process.

Download buttons and formats

After generation, the download buttons appear next to the certificate data. Each button exports the same certificate or the same key pair in a different representation.

Certificate .pfx and Certificate .p12

These are two extensions for the PKCS#12 binary format. Each file bundles the certificate and private key in a single package, useful for import into Windows/IIS, browsers, Java and other platforms. Both buttons generate the same content, changing only the file extension.

Before downloading, fill in PFX/P12 password to protect these two files. If the field is empty, they are generated without a password.

Certificate .cer

Exports only the public certificate in binary DER format. It does not contain the private key and can be used to distribute the identity and public key to systems that need to validate signatures or trust.

Certificate .pem

Exports only the certificate as Base64 text between the BEGIN CERTIFICATE and END CERTIFICATE markers. It is widely used on Linux servers such as Nginx and Apache, load balancers and APIs.

Public Key .pem

Exports the public part of the RSA key as PEM text. It can be shared to verify signatures or encrypt data intended for the private key holder.

RSA Private Key .pem

Exports the private key in the traditional PKCS#1 format, identified by the BEGIN RSA PRIVATE KEY marker. It is common in OpenSSL-based tools and integrations.

PKCS8 Private Key .pem

Exports the same private key in PKCS#8 format, identified by the BEGIN PRIVATE KEY marker. It is a more generic and interoperable representation, widely accepted by Java, Node.js, Python and other modern libraries.

Public Key .jwk

Exports the public key as a JSON Web Key, a common format in JWT, OAuth 2.0 and OpenID Connect. It can be used by other systems to validate signatures and can be part of a public JWKS set.

Private Key .jwk

Exports all private RSA key parameters as JSON. Despite the readable format, it is still a private key and must never be published or sent to third parties.

Download All (.zip)

Bundles all formats above into a single ZIP file. The provided password protects only the PFX and P12 files: the ZIP, private PEM files and private JWK are not encrypted by that password.

Protect private keys: anyone who obtains a private key can impersonate the holder, sign data or access information protected by the key pair. Keep private files in a secure location and avoid sharing them.

About the self-signed X.509 certificate

An X.509 certificate associates an identity with a public key. In this tool, the certificate itself is signed by the private key that was just generated, without validation by an external Certificate Authority. Therefore, it can be used when participants configure trust manually, for example in:

development environments and internal tests;
TLS communication between services on a private network;
JWT signing and validation in internal APIs;
mutual authentication (mTLS) between controlled services;
study of certificates, RSA cryptography and public key infrastructure.