A self‑signed certificate is an SSL/TLS certificate that is signed by its own private key instead of a trusted Certificate Authority (CA). It provides the same encryption as a CA‑signed certificate but is not inherently trusted by browsers, making it suitable for testing, development, and internal networks.

You should use self‑signed certificates only for non‑production environments: local development, staging servers, internal APIs, CI/CD pipelines, or IoT device testing. They are not suitable for public websites because browsers will show security warnings.

You need to manually import the generated certificate into your operating system’s or browser’s trust store. For example, on macOS you can add it to the Keychain and set it to “Always Trust”. For local development, tools like mkcert simplify this process.

RSA keys are widely supported and have been the standard for many years. ECDSA (Elliptic Curve Digital Signature Algorithm) provides equivalent security with much smaller key sizes (e.g., a 256‑bit ECDSA key is comparable to a 3072‑bit RSA key), resulting in faster TLS handshakes and less CPU usage. Both are supported by modern browsers and servers.

You can use OpenSSL to combine the certificate and private key into a PFX file:
openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt
You will be prompted for an export password. This format is commonly used on Windows servers (IIS).

Yes. All key generation and certificate creation happens entirely in your browser. No data is ever sent to any server. The private key never leaves your device. You can verify this by using the browser’s developer tools (Network tab).