Linux Tips

Generate a Self-Signed SSL Certificate with OpenSSL

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #76:

Question: I need SSL for local development. How do I generate a certificate quickly?

Try: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -nodes -subj '/CN=localhost'

Info: Generates a 4096-bit RSA self-signed certificate valid for 1 year. The -x509 option creates a self-signed certificate, while -subj supplies the certificate subject without interactive prompts.

Examples:

  • $ openssl req -x509 -newkey ec:<(openssl ecparam -name prime256v1) -keyout key.pem -out cert.pem -nodes -days 365  # Generate an ECDSA certificate
  • $ openssl s_client -connect example.com:443 -showcerts  # View a remote server's certificate chain
  • $ certbot certonly --standalone -d example.com  # Request a Let's Encrypt certificate

Note: Self-signed certificates are suitable for local development and testing but normally trigger browser trust warnings. For public production websites, use a certificate issued by a trusted certificate authority such as Let's Encrypt. The -nodes option creates the private key without encryption, so protect key.pem carefully.




LinuxTeck.com 
linuxteck:~$ openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -nodes -subj '/CN=localhost'
.+...+........+...+...+.....+...+......+...+...+...+...+...+...+...
.....+...+...+...+...+...+...+...+...+...+...+...+...+...+...

linuxteck:~$ ls -la cert.pem key.pem
-rw-r--r-- 1 linuxteck linuxteck 2004 Sep 25 10:45 cert.pem
-rw------- 1 linuxteck linuxteck 3272 Sep 25 10:45 key.pem

linuxteck:~$ openssl x509 -in cert.pem -noout -subject -dates
subject=CN = localhost
notBefore=Sep 25 10:45:23 2026 GMT
notAfter=Sep 25 10:45:23 2027 GMT
linuxteck:~$

PREVIOUS ARTICLE Quick Linux Tip #75: Pin Linux Processes to Specific CPUs with taskset NEXT ARTICLE Quick Linux Tip #77: Git Diff Between Main and Feature Branch
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.