Self-signed certificates can be used to secure web connections, encrypt data sent over the internet, and can be used to authenticate the identity of the server to the client. In this blog post, we will cover the basics of self-signed certificates, how to create them, and how to use them to secure your web connections.
Creating a Self-Signed Certificate
There are several ways to create a self-signed certificate, but in this blog post, we will cover two popular methods: using mkcert and using PowerShell in-built (New-SelfSignedCertificate) cmdlet.
Method 1: Using mkcert
mkcert is a simple command-line tool that can be used to create a self-signed certificate. To create a self-signed certificate using mkcert, you can use script at and can run on PowerShell.
Once you run the script it will first download the mkcert.exe if not exist, and using that will create the Self-Signed Certificate.
Your directory will looks like below:
Method 2: Using PowerShell
Another way to create a self-signed certificate is by using PowerShell in-built 'New-SelfSignedCertificate' cmdlet. Here is an example of how to use this cmdlet to create a self-signed certificate:
Option 1: Creating a DNS based self-signed certificate
This command will create a self-signed certificate for the different hostnames and store it in the local certificate store.
Option 2: Creating a DNS + IP Address based self-signed certificate
This command will create a self-signed certificate for couple of domains and IP addresses and store it in the local certificate store.
If you want to have the Signer for the Self-Signed certificate then you can first generate the root certificate and then pass that root certificate while creating the other Self-Signed certificate.
$rootCert = New-SelfSignedCertificate -Subject 'CN=TestRootCA,O=TestRootCA,OU=TestRootCA' -KeyExportPolicy Exportable -KeyUsage CertSign,CRLSign,DigitalSignature -KeyLength 2048 -KeyUsageProperty All -KeyAlgorithm 'RSA' -HashAlgorithm 'SHA256' -Provider 'Microsoft Enhanced RSA and AES Cryptographic Provider'
New-SelfSignedCertificate -Subject $certFriendlyName -FriendlyName $certFriendlyName -Signer $rootCert -TextExtension @("2.5.29.17={text}$ip&$dnsNames") -CertStoreLocation "cert:\LocalMachine\My" -KeyAlgorithm RSA -KeyLength 2048 -NotAfter (Get-Date).AddYears(10)
Note: Self-signed certificates are not trusted by default and will not be recognized by default trusted root CA, so it is important to inform users that they are visiting a self-signed certificate website.
Thanks for reading, CloudOps ⌂Signing Off! 😊
