What Is a Self-Signed Certificate? (And When to Avoid It)

For an SSL certificate to do its job, two things are needed: it has to encrypt the connection, and it has to be vouched for by a trusted authority. A self-signed certificate does only the first. That's exactly why browsers stop and warn when they see one.

What Is a Self-Signed Certificate?

Normally a certificate is signed by a trusted Certificate Authority (CA); browsers trust the certificate because they recognize the CA. With a self-signed certificate, you sign it with your own private key. So the certificate vouches for itself. It's technically a valid certificate and it encrypts traffic — but there's no third party providing trust.

Why Does the Browser Warn?

The browser tries to trace a certificate's signature up to a root it recognizes. With a self-signed certificate that chain points back to itself, so the browser says "no one guarantees this certificate" and shows a "your connection is not private" type of warning. Even though the encryption works, the user hits that screen.

When Is It Appropriate?

• Local development — to test HTTPS on your own machine.
• Internal systems — internal tools only your team accesses, where you manually trust the certificate.
• Test environments — temporary, non-public servers.

How Do You Create One?

It's usually generated with a single openssl command:

This produces a private key and a self-signed certificate. It's only suitable for testing/internal purposes.

A self-signed certificate encrypts but doesn't earn trust — because no one has vouched for it.