Self-Signed Certificate

A self-signed certificate is one where the issuer and the subject are the same: the certificate is signed by its own private key rather than by a certificate authority. There is no chain to a trusted root, so clients cannot verify it independently.

Why it matters

Browsers show warnings such as NET::ERR_CERT_AUTHORITY_INVALID, and tools like curl report self-signed certificate or unable to get local issuer certificate. That is correct behavior, because anyone can create a certificate claiming to be your domain.

They are still useful in the right place: local development, internal test systems, or devices where you control every client and can pin or install the certificate. For anything public, a free ACME certificate removes the need for them.

Example

Create one for local use:

openssl req -x509 -newkey rsa:2048 -nodes -days 365   -keyout dev.key -out dev.crt -subj "/CN=localhost"   -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

Then add dev.crt to your own trust store if you want to avoid warnings. Tools like mkcert automate this with a local CA.

Common mistakes

• Telling users to click through warnings, which trains them to ignore real attacks.
• Using curl -k or disabling verification in production code.
• Omitting the SAN extension, which modern clients require.

Related

• Certificate authority
• Root store
• Man-in-the-middle attack
• Guide: SSL/TLS certificate errors explained

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.