📜 自签名 SSL 证书生成器Self-Signed SSL Certificate Generator

使用说明与常见问题How-to & FAQ

「自签名 SSL 证书生成器」是什么？What is the Self-Signed SSL Certificate Generator tool?

在浏览器本地生成自签名 X.509 SSL/TLS 证书和私钥（PEM 格式）：支持 RSA 2048/3072/4096 和 ECDSA P-256/P-384，可填写多个域名和 IP（SAN）、有效期和组织信息，也能生成本地 CA 根证书，私钥不会离开你的电脑。Generate a self-signed X.509 SSL/TLS certificate and private key (PEM) right in your browser: RSA 2048/3072/4096 or ECDSA P-256/P-384, multiple domains and IPs (SAN), validity and organisation details, or a local CA root — the private key never leaves your device.

如何使用「自签名 SSL 证书生成器」？How do I use the Self-Signed SSL Certificate Generator?

填写通用名称（域名）和备用名称（每行一个域名或 IP，支持 *.example.com 通配符），选择密钥类型和有效期，点击「生成证书」。下载 .crt 和 .key 文件后即可在 Nginx、Apache 或本地开发服务器中使用。自签名证书不受浏览器信任，仅适合开发测试和内网环境。Enter the common name (domain) and alternative names (one domain or IP per line, wildcards like *.example.com allowed), pick a key type and validity, then click Generate. Download the .crt and .key files for Nginx, Apache or a local dev server. Self-signed certificates are not trusted by browsers and suit only development, testing and internal use.

自签名证书安全吗？浏览器为什么提示不安全？Is a self-signed certificate secure? Why do browsers warn?

加密强度和正式证书一样，但没有受信任的证书机构为它担保，所以浏览器会提示「不安全」。它适合本地开发、测试和内网服务；面向公众的网站请使用 Let’s Encrypt 等机构签发的免费证书。私钥在你的浏览器中通过 Web Crypto 生成，不会上传。The encryption is as strong as a public certificate, but no trusted authority vouches for it, so browsers warn. Use it for local development, testing and internal services; public sites should use a free CA certificate such as Let’s Encrypt. The key is generated in your browser with Web Crypto and never uploaded.

怎样让本机信任这个证书？How do I make my computer trust it?

勾选「生成 CA 根证书」生成一张根证书，把 .crt 导入系统或浏览器的「受信任的根证书颁发机构」（Windows 证书管理器、macOS 钥匙串，或 Linux 的 /usr/local/share/ca-certificates 后运行 update-ca-certificates）。也可以直接导入普通的自签名证书。只信任你自己生成的证书。Tick “Make it a CA root” and import the .crt into the trusted root store (Windows Certificate Manager, macOS Keychain, or /usr/local/share/ca-certificates plus update-ca-certificates on Linux). You can also import a plain self-signed certificate directly. Only trust certificates you generated yourself.

为什么要填写 SAN（备用名称）？Why fill in SAN?

现代浏览器只根据 SAN 扩展匹配域名，不再看 CN。工具会自动把 CN 加入 SAN；需要用 IP 访问时（如 192.168.1.10）也要把 IP 写进 SAN。Modern browsers match hostnames only against the SAN extension, not the CN. The tool adds the CN to SAN automatically; add IPs too (e.g. 192.168.1.10) if you connect by address.

「自签名 SSL 证书生成器」免费吗？数据会上传吗？Is the Self-Signed SSL Certificate Generator free? Is my data uploaded?

「自签名 SSL 证书生成器」完全免费，无需注册或安装，手机和电脑都能用；所有处理都在你的浏览器本地完成，输入的内容和文件不会上传到服务器。The Self-Signed SSL Certificate Generator is completely free with no sign-up or install and works on phones and desktops; everything runs locally in your browser and nothing you enter is uploaded.