Free tool

OpenSSL commands, or skip them.

People search for “openssl req -x509 localhost” every day. Here are the commands. If you would rather not install OpenSSL, generate the same self-signed SSL certificate in the browser.

Self-signed cert for localhost

openssl req -x509 -newkey rsa:2048 -sha256 -days 365 -nodes \
  -keyout localhost.key -out localhost.crt \
  -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

CSR only (keep the key)

openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.key -out example.csr \
  -subj "/CN=example.com"

PFX / PKCS#12 from cert + key

openssl pkcs12 -export -inkey localhost.key -in localhost.crt -out localhost.pfx

When the CLI is the wrong tool

OpenSSL is correct and scriptable. It is also easy to omit SANs, which makes browsers reject localhost HTTPS. SelfSignedCert fills SANs by default and never sends the private key off the device.