Buy from the highest-rated provider   Buy DigiCert Certificate x

How to Create and Install an Apache Self Signed Certificate

Apache Self Signed CertificateSSL is an essential part of creating a secure Apache site. SSL certificates allow you encrypt all the traffic sent to and from your Apache web site to prevent others from viewing all of the traffic. It uses public key cryptography to establish a secure connection. This means that anything encrypted with a public key (the SSL certificate) can only be decrypted with the private key (stored only on the server) and vice versa.

When to Use a Self Signed Certificate

You should never use a self signed certificate on an e-commerce site or any site that transfers valuable personal information like credit cards, social security numbers, etc.

An SSL certificate is necessary for more than just distributing the public key: if it is signed by a trusted third-party, it verifies the identity of the server so clients know they aren’t sending their information (encrypted or not) to the wrong person. So what is a self signed certificate? It is a certificate that is signed by itself rather than a trusted third party. Isn’t that bad? In most cases, yes. You will almost never want to use a self signed certificate on a public Apache server that requires anonymous visitors to connect to your site because they could easily become a victim of a man-in-the-middle attack. However, self signed certificates have their place:

  • Self signed certificates can be used on an Apache development server. There is no need to spend extra cash buying a trusted certificate when you are just developing or testing an application.
  • Self signed certificates can be used on an intranet. When clients only have to go through a local intranet to get to the server, there is virtually no chance of a man-in-the-middle attack.
  • Self signed certificates can be used on personal sites with few visitors. If you have a small personal site that transfers non-critical information, there is very little incentive for someone to attack the connection.

Just keep in mind that visitors will see a warning in their browsers (like the one below) when connecting to an Apache site that uses a self signed certificate until it is permanently stored in their certificate store. You should never use a self signed certificate on an e-commerce site or any site that transfers valuable personal information like credit cards, social security numbers, etc. Just lay down a few dollars on a trusted cheap SSL certificate or a free SSL certificate.

Apache Self signed Certificate Error in Firefox

Generate Your Apache Self Signed Certificate

Great! So now you know when to use an Apache self signed certificate and when not to. Now, let’s create one: First, we need to make sure OpenSSL is installed. If you are installing the self signed certificates on Windows, grab the Windows version of OpenSSL (If you get an error when you run the installer, you may need to download the Visual C++ 2008 Redistributables listed on that page first). If you are on another type of server, try running “openssl” on the command line to see if OpenSSL is already installed. If it is not, you will need to download a package or compile it from its source.

Once you have OpenSSL installed, just run this one command to create an Apache self signed certificate:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout mysitename.key -out mysitename.crt

How to generate an Apache self signed certificate with OpenSSL

You will be prompted to enter your organizational information and a common name. The common name should be the fully qualified domain name for the site you are securing ( You can leave the email address, challenge password, and optional company name blank. When the command is finished running, it will create two files: a mysitename.key file and a mysitename.crt self signed certificate file valid for 365 days.

Install Your Self Signed Certificate

Now, you just need to configure your Apache virtual host to use the SSL certificate. If you only have one Apache virtual host to secure and you have an ssl.conf file being loaded, you can just edit that file. Otherwise, you will need to make a copy of the existing non-secure virtual host, paste it below, and change the port from port 80 to 443.

  1. Open your Apache configuration file in a text editor. Depending on your operating system and Apache version, it will be located in different places but you will usually find it at /etc/httpd/httpd.conf. On a Windows machine, you will usually find it at C:\Program Files\Apache\Apache2\conf\httpd.conf
  2. In most cases, you will find the <VirtualHost> blocks in a separate file in a directory like /etc/httpd/vhosts.d/ or /etc/httpd/sites/. Add the lines in bold below. <VirtualHost>
    DocumentRoot /var/www/website
    SSLEngine on
    SSLCertificateFile /etc/ssl/crt/mysitename.crt
    SSLCertificateKeyFile /etc/ssl/crt/mysitename.key

  3. Change the names of the files and paths to match your certificate files. Save the changes and exit the text editor.
  4. Restart your Apache web server using one of the following commands: /usr/local/apache/bin/apachectl startssl
    /usr/local/apache/bin/apachectl restart

Learn more about installing a certificate in Apache.

Check the Apache Self Signed Certificate Installation

View an Apache self signed certificate in FirefoxIf the Apache site is public, you can use our SSL Checker to verify that it is installed correctly (ignoring the warning that it is not trusted because it is self signed). Otherwise, just go to the website in your web browser using https in the address bar ( and verify that the certificate is being given out by the server by clicking the certificate icon (after clicking through the warnings).

For more information on generating an Apache self signed certificate, see the following links:

Originally posted on Sat Oct 16, 2010



After using this command

"openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout mysitename.key -out mysitename.crt"

2 files should be created a mysitename.key file and a mysitename.crt. but where are they store ? can some one please tell i can not seem to find then.


it is created in your openssl bin directory


Hi jason,

The files will be created in the same directory where you run the command.



If I create the ssl self signed certificate then can i use the same certificate for postfix and dovecot? Will it work for IMAPS and POP3S?
Will it encrypt mails sent through webmail? and can i configure for



I am trying to setup the SSL certificate in my development environment which is Windows 2003 server and Apache 2.2 with the steps given above.

I downloaded Win32OpenSSL-1_0_1e.exe and installed it. When running the openssl command i am getting the below error. please help to fix it.

C:\OpenSSL-Win32\bin>openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout
sv10.key -out sv10.crt
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
Unable to load config info from /usr/local/ssl/openssl.cnf


Will Gardner(2016-02-18)

got the same error. Try -config /path/to/openssl.cfg option.


please read the manual before posting (here is the hint):
penssl req -new -x509 -extensions v3_ca -keyout \
private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf


you should copy them under /etc/httpd/conf/


Hello - if I'm creating a self-signed certificate, for the sake of development or plain autonomy, why would I involve an intermediary certificate? I see you discuss it in the first paragraph, but you never really address where to acquire one. I either do not understand what a self-signed certificate is, or there is something missing here. I'm looking to create my own, not seek any third-party: is this possible? What do I do if I have no intermediate certificate, or where do I create my own?



You may try this
Run command at > C:\Program Files (x86)\APACHE~1\Apache2.2\bin>openssl x509 -req -days 365 -in certificatename.csr -signkey certificatename.key -out certificatename.crt

copy certificatename.crt from > C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin to > C:\Program Files (x86)\Apache Software Foundation\Apache2.2\conf

then restart TOMCAT & APACHE services


C:\Program Files (x86)\APACHE~1\Apache2.2\bin>openssl x509 -req -days 365 -in certificatename.csr -signkey certificatename.key -out certificatename.crt

this command is showing error certificatename.csr not found


Thanks for your valuable posting.I have collect more than information from your website. It's really wonderful blog. please added more than tips. i'm working in a top cms in chennai.Here providing very low price CMS , responsive webdesign and ERP. you have any more than information kindly make me call this number 044-42127512 or send your mail


Great post, thanks

ob prasad(2014-12-13)


I installed below edition in my server
Apache/2.4.4 (Win32) OpenSSL/0.9.8y PHP/5.4.19
and using the SSL certified one. It is installed properly. But frequently it is getting struck some where. For this I am temporarily restarting the my Apache server. When it is struck at that time apache is working through http. On https:// only I am getting the problem. I didn't found the any error also when it is struck.

Please suggest me.

Dave m(2015-02-18)


The files you refer to in your VirtualHost example are named differently than your example for generating them, and you don't mention whether the user should replace the paths and names or not. Just a humble suggestion, but maybe you should use a more blatant placeholder such as /path/to/your... or, even better, stick with the names and locations from your example generation above. Otherwise this could be a frustrating wall for a new user (like me) to hit.

The one thing that did confuse me was the reference to intermediate.crt, which you didn't mention generating, and which does not exist on my system along the path you show in the example.

Finally, and most frustrating for me, following your instructions to generate the keys, I wind up getting these errors when trying to start Apache:

[Wed Feb 18 16:37:33.312971 2015] [ssl:warn] [pid 10197:tid 140231042328448] AH01906: server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)

[Wed Feb 18 16:37:33.313677 2015] [ssl:error] [pid 10197:tid 140231042328448] AH02579: Init: Private key not found

[Wed Feb 18 16:37:33.313775 2015] [ssl:error] [pid 10197:tid 140231042328448] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag

[Wed Feb 18 16:37:33.313850 2015] [ssl:error] [pid 10197:tid 140231042328448] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error

[Wed Feb 18 16:37:33.313938 2015] [ssl:error] [pid 10197:tid 140231042328448] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag

[Wed Feb 18 16:37:33.314007 2015] [ssl:error] [pid 10197:tid 140231042328448] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA)

[Wed Feb 18 16:37:33.314091 2015] [ssl:error] [pid 10197:tid 140231042328448] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib

[Wed Feb 18 16:37:33.314211 2015] [ssl:error] [pid 10197:tid 140231042328448] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag

[Wed Feb 18 16:37:33.314283 2015] [ssl:error] [pid 10197:tid 140231042328448] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)

SSL Shopper(2015-02-18)

Thanks for the feedback, Dave. I updated the article to be less misleading. I'm not sure what is causing the error you are receiving though. You may need to regenerate the certificate and key and make sure the paths to the files are correct.

Jorge Díaz(2016-12-05)


Russell Schiwal(2017-06-06)

Good description, but some instructions were for Windows and others were for Linux. Fortunately, If a person has already installed a LAMP server, they should be able to catch the discrepancy.

Sean Connelly(2018-02-21)

I keep finding these tutorials and the "" is never EVER explained. This is for localhost, and it won't allow me to use my local IP so how do I use a domain name on a localhost???

Guillaume Lundi(2018-03-06)

Just use localhost as ServerName


If you are on linux edit /etc/hosts
if you are on windows edit
c:/windows/system32/drivers/etc/hosts (as admin)
add the same line
and use on your localhost :)