How it works
Complete the job in three clear steps
- Enter the certificate subject and choose the key algorithm.
- Generate and cryptographically verify the result locally.
- Download the generated PEM files, then protect the unencrypted private key.
Private Web Crypto certificate tool
Self-Signed Certificate Generator
Generate a locally signed X.509 development certificate with DNS SANs, configurable validity, and matching public/private PEM keys.
Free to use The key pair is generated in this browser with Web Crypto and is never sent to Lucaden. Results are not retained by this tool.
Loading tool workspace…
Important
Check the result before relying on it
Scan-test generated codes before printing or distribution. A generated barcode does not register identifier ownership, and decoded external links should be checked before opening.
Practical details
What this Lucaden tool does
Generate a locally signed X.509 development certificate with DNS SANs, configurable validity, and matching public/private PEM keys.
The workspace exports standards-based PEM output, proof-checks the generated signature, and never persists the unencrypted private key.
Included capabilities
- ECDSA or RSA keys
- DNS subject alternative names
- Configurable validity period
- Self-signature verification
Useful for
- Create a local development certificate
- Build test fixtures
- Exercise certificate import
- Prototype an internal service
Questions
About this tool
Does Lucaden receive or save the private key?
No. Web Crypto creates and exports it in this browser. This workspace does not upload it or put it in local storage.
Is the downloaded private key encrypted?
No. It is an unencrypted PKCS#8 PEM. Store it only in an access-controlled secret manager or encrypt it with an appropriate offline workflow.
Open-source foundations
Built transparently
Lucaden documents its standards sources, architectural references, and permissive runtime dependencies while keeping this workspace consistent with the Lucaden interface.