DevTools Logo

PKI Key Pair Generator

PKI Key Pair Generator

Generate RSA keys, self-signed X.509 certificates and CSRs with node-forge — fully client-side

PKI settings

About this tool

TLS development often needs self-signed certificates or CSRs before a real CA is involved. OpenSSL commands are powerful but easy to mistype.

Generate RSA or ECDSA key pairs, self-signed X.509 certificates with SAN for your CN, or PKCS#10 CSRs — all as PEM text in the browser via node-forge.

How to use

  1. Mode

    Pick key pair, self-signed cert or CSR output.

  2. Subject

    Set CN, organization and country for cert/CSR modes.

  3. Copy PEM

    Import certificate and key into nginx, Caddy or local trust store.

Common mistakes

Mistake:Using self-signed certs in production.

Fix:Self-signed material is for dev/test only — use a public or internal CA for production TLS.

Frequently asked questions

Related guides

SSH Key Pair Generator: Ed25519, RSA and OpenSSH Format Online

Generate SSH keys with OpenSSH public format, PEM private key and SHA256 fingerprint — Web Crypto in the browser.

PKI Key Pair Generator: Self-Signed Certs and CSRs in the Browser

Generate RSA/ECDSA keys, self-signed X.509 certificates and PKCS#10 CSRs online with node-forge — for local HTTPS and dev TLS.

Related tools

AES Encryption

Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.

Basic Auth Generator

Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.

Bcrypt Generator & Verifier

Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.

BIP39 Mnemonic Generator

Generate and validate BIP39 seed phrases locally for testing

Checksum Calculator

Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API

CORS Header Validator

Validate Cross-Origin Resource Sharing headers for security compliance