Guide

A local CA, then host certs.

Trusting a new self-signed cert on every laptop does not scale. A Root CA is one trust decision. Host certificates are the leaves you put on servers.

The three steps

1. Generate a Root CA. Download ca.crt and keep ca.key offline.

2. Install ca.crt in the OS or browser trust store.

3. Issue a host certificate for each hostname. SelfSignedCert can use the CA still sitting in this tab, or you can paste the CA PEM.

Do not put the CA key on the web server

Anyone with the CA private key can impersonate every host you issue. The host .key belongs on the server. The CA key does not.