What is the difference between a self-signed certificate and a CA-signed certificate?

A self-signed certificate is issued by yourself and is not trusted by browsers or operating systems by default — users will see a security warning. A CA-signed certificate is issued by a trusted third-party authority (e.g. Let's Encrypt, DigiCert) and is trusted by browsers by default. There is no difference in encryption strength — only in the trust chain.

Can I use self-signed certificates in production?

Not recommended. Production environments should use certificates signed by a trusted CA. Let's Encrypt offers free SSL certificates that fully meet production needs. Self-signed certificates cause browser security warnings, affecting user experience and trust, and can be exploited by man-in-the-middle attacks.

How to make browsers trust a self-signed certificate?

You need to add the CA root certificate to the operating system's trusted certificate store. On macOS, add via Keychain Access; on Windows, import via Certificate Manager to "Trusted Root Certification Authorities"; on Linux, use the update-ca-certificates command. Restart the browser after importing.

What are the differences between certificate file formats?

Common formats: PEM (.pem/.crt/.cer, Base64 text) is most common on Linux/Unix; DER (.der/.cer, binary) is common on Windows; PKCS12/PFX (.pfx/.p12, includes certificate + private key) is the Windows/IIS format. PEM and DER can be converted using the openssl x509 command.

Self-Signed Certificate Guide

Complete tutorial for generating CA root, server, and client certificates using OpenSSL

⚠️ Security Warning: Self-signed certificates are for development testing and internal services only. For production, use certificates signed by a trusted CA (e.g. Let's Encrypt).

Step 1: Generate CA Root Certificate

The CA (Certificate Authority) root certificate is used to sign server and client certificates — it's the foundation of the certificate trust chain.

Generate CA Private Key

openssl genrsa -out ca.key 4096

Generate CA Root Certificate (10-year validity)

openssl req -new -x509 -days 3650 -key ca.key -out ca.crt \
  -subj '/C=CN/ST=Beijing/L=Beijing/O=MyOrg/OU=Dev/CN=My CA'

Step 2: Generate Server Certificate

The server certificate is used for HTTPS services, signed by the CA root certificate.

Generate Server Private Key

openssl genrsa -out server.key 2048

Create SAN Config File (server.cnf)

[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
req_extensions = v3_req

[dn]
C = CN
ST = Beijing
L = Beijing
O = MyOrg
OU = Dev
CN = example.com

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = example.com
DNS.2 = *.example.com
DNS.3 = localhost
IP.1 = 127.0.0.1
IP.2 = ::1

Generate Server CSR

openssl req -new -key server.key -out server.csr -config server.cnf

Sign Server Certificate with CA (1-year validity)

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -out server.crt -days 365 \
  -extensions v3_req -extfile server.cnf

Step 3: Generate Client Certificate

The client certificate is used for mutual TLS (mTLS) authentication to verify client identity.

Generate Client Private Key

openssl genrsa -out client.key 2048

Generate Client CSR

openssl req -new -key client.key -out client.csr \
  -subj '/C=CN/ST=Beijing/L=Beijing/O=MyOrg/OU=Dev/CN=Client'

Sign Client Certificate with CA

openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -out client.crt -days 365

Certificate Trust Chain

CA Root Certificate

ca.crt / ca.key

Self-signed, 10-year validity

└── signs ↓

Server Certificate

server.crt / server.key

For HTTPS services

Client Certificate

client.crt / client.key

For mTLS client authentication

Scenario 1: Local Development (localhost)

Generate certificates for localhost development. Browsers will show a warning — you need to manually trust the CA.

localhost SAN Config

[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
req_extensions = v3_req

[dn]
C = CN
ST = Beijing
L = Beijing
O = DevOrg
OU = Dev
CN = localhost

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = *.localhost
IP.1 = 127.0.0.1
IP.2 = ::1

Trust the CA certificate:

macOS: Double-click ca.crt → Keychain Access → Always Trust
Windows: Double-click ca.crt → Install to "Trusted Root Certification Authorities"
Chrome: Settings → Privacy & Security → Security → Manage Certificates → Import

Scenario 2: Internal Services

Generate certificates for internal IPs or domains, suitable for enterprise APIs and admin panels.

Internal Service SAN Config Example

[alt_names]
DNS.1 = api.internal.company.com
DNS.2 = admin.internal.company.com
DNS.3 = *.internal.company.com
IP.1 = 192.168.1.100
IP.2 = 10.0.0.50

Nginx Configuration

Nginx HTTPS Configuration

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate     /path/to/server.crt;
    ssl_certificate_key /path/to/server.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    # 可选：双向 TLS (mTLS)
    # ssl_client_certificate /path/to/ca.crt;
    # ssl_verify_client on;

    location / {
        proxy_pass http://127.0.0.1:3000;
    }
}

# HTTP 跳转 HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

Apache Configuration

Apache HTTPS Configuration

<VirtualHost *:443>
    ServerName example.com

    SSLEngine on
    SSLCertificateFile      /path/to/server.crt
    SSLCertificateKeyFile   /path/to/server.key
    SSLCertificateChainFile /path/to/ca.crt

    # 可选：双向 TLS (mTLS)
    # SSLCACertificateFile  /path/to/ca.crt
    # SSLVerifyClient require

    ProxyPass / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/
</VirtualHost>

Viewing & Renewing Certificates

View Certificate Info

openssl x509 -in server.crt -text -noout

View Certificate Validity

openssl x509 -in server.crt -noout -dates

Verify Certificate Chain

openssl verify -CAfile ca.crt server.crt

Renew Server Certificate (re-sign)

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -out server.crt -days 365 \
  -extensions v3_req -extfile server.cnf

Convert to PFX/PKCS12 Format (Windows/IIS)

openssl pkcs12 -export -out server.pfx -inkey server.key \
  -in server.crt -certfile ca.crt