Certificate Generator

Generate a new certificate chain or issue a server certificate using your existing root or intermediate CA. All keys are generated client-side and never leave your browser.

Settings

New key algorithm

New private key passphrase (optional)

Encrypts generated PEM keys with AES-256. Empty exports unencrypted keys. Changing this clears results; generate again to apply it. PFX has its own passphrase below.

Certificate lifetimes

Root CA validity (days) New intermediate validity (days)

Server validity (days)

Each child certificate is capped at its signing CA's expiry. The actual validity dates appear in the results.

1. Root CA

Common Name (CN)

Organization (O)

Country (C)

2. Intermediate CA

Sign server directly with selected CA

Common Name (CN)

Organization (O)

Country (C)

3. Server Certificate

Also allow client authentication (mTLS)

Common Name (CN)

Organization (O)

Country (C)

Quick Presets

Subject Alternative Names (SANs)

dns localhost ip 127.0.0.1

Configure settings above and click "Generate Certificate Chain" to create certificates

About Certificate Generator: Generate self-signed certificate chains for development, testing, and internal PKI. Supports RSA and ECDSA key algorithms with configurable validity periods. All cryptographic operations run entirely in your browser — private keys are never transmitted anywhere. Add the Root CA to your system trust store to avoid browser warnings during local development.