Self-Signed Certificate

A self-signed certificate is one where the issuer and the subject are the same: the certificate is signed by its own private key rather than by a certificate authority. There is no chain to a trusted root, so clients cannot verify it independently.

Why it matters

Browsers show warnings such as NET::ERR_CERT_AUTHORITY_INVALID, and tools like curl report self-signed certificate or unable to get local issuer certificate. That is correct behavior, because anyone can create a certificate claiming to be your domain.

They are still useful in the right place: local development, internal test systems, or devices where you control every client and can pin or install the certificate. For anything public, a free ACME certificate removes the need for them.

Example

Create one for local use:

openssl req -x509 -newkey rsa:2048 -nodes -days 365   -keyout dev.key -out dev.crt -subj "/CN=localhost"   -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

Then add dev.crt to your own trust store if you want to avoid warnings. Tools like mkcert automate this with a local CA.

Common mistakes

• Telling users to click through warnings, which trains them to ignore real attacks.
• Using curl -k or disabling verification in production code.
• Omitting the SAN extension, which modern clients require.

Related

• Certificate authority
• Root store
• Man-in-the-middle attack
• गाइड: SSL/TLS certificate errors explained

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.