Self-Signed Custom SSL

Self-Signed Custom SSL Certificates

A self-signed certificate can encrypt traffic between users and an application, but browsers do not trust it automatically because it is not signed by a recognised Certificate Authority.

Self-signed certificates are suitable for development, testing, private systems, and small internal audiences. They are not recommended for public production websites because visitors receive a browser warning before they can continue.

Browser warning for a self-signed SSL certificate
Browsers warn users when the certificate is not trusted by a recognised Certificate Authority.
On this page

Requirements and Limitations

Custom DomainPurchase and configure a domain name before creating the certificate.
OpenSSLUse OpenSSL on Windows, Linux, macOS, FreeBSD, or an Elastic VPS.
Untrusted by DefaultBrowsers display a security warning unless the custom root certificate is trusted manually.
Development UseRecommended for testing and private systems rather than public production projects.
Important: Do not protect the server private key with a passphrase. A passphrase-protected key cannot be uploaded successfully through the platform Custom SSL interface.

Generate a Certificate on Windows

Download and extract OpenSSL for Windows, then run openssl.exe from its bin directory. Generated files are saved there by default.

1Create the root CA private key

genrsa -out {filename} {length}
  • {filename} — output key name, for example rootCA.key.
  • {length} — key size in bits, for example 2048.

2Create the self-signed root CA certificate

req -config {config_path} -x509 -new -key {keyname} -days {days} -out {filename}
  • {config_path} — full path to openssl.cnf.
  • {keyname} — root key, for example rootCA.key.
  • {days} — certificate validity period.
  • {filename} — root certificate, for example rootCA.crt.

3Create the domain private key

genrsa -out {filename} {length}

Example output name: host.key.

4Create the certificate signing request

req -config {config_path} -new -key {keyname} -out {filename}
The Common Name value must match the purchased domain name, otherwise the certificate will not validate for that hostname.

5Sign the server certificate with the root CA

x509 -req -in {requestname} -CA {CA_certificate} -CAkey {CA_key} -CAcreateserial -out {filename} -days {days}

Generate a Certificate on Linux, macOS, or FreeBSD

Install OpenSSL when it is not already available. For Ubuntu or Debian:

sudo apt-get install openssl

1Create the root CA key

openssl genrsa -out {filename} {length}

2Create the root CA certificate

openssl req -x509 -new -key {keyname} -days {days} -out {filename}

3Create the domain private key

openssl genrsa -out {filename} {length}

4Create the CSR

openssl req -new -key {keyname} -out {filename}

5Sign the certificate

openssl x509 -req -in {requestname} -CA {CA_certificate} -CAkey {CA_key} -CAcreateserial -out {filename} -days {days}

Generate a Certificate on Elastic VPS

  • Create an environment with an Elastic VPS.
  • Connect through a public IP or SSH Gateway.
  • Open the OpenSSL shell.
  • Follow the Linux workflow.
  • When already inside the OpenSSL shell, omit the leading openssl word from each command.
  • Download the generated files through the Configuration File Manager.

Attach the Certificate

Apply the generated files using the normal Custom SSL workflow:

  • Adjust the environment topology.
  • Configure the domain name and A record.
  • Upload the private key, domain certificate, and root or intermediate certificate to the environment.

Open the Application over HTTPS

Open the custom domain or attached external IP using https://. The browser displays a warning because the certificate is not trusted automatically.

Proceed carefully: Continue only when the certificate belongs to your own application and you understand why the browser does not trust it.

Some browsers, including Firefox, may require the site to be added to the exception list before access is allowed.

After accepting the warning, the application opens through an encrypted HTTPS connection.

What’s next?