A self-signed certificate is an X.509 certificate whose subject and issuer are the same: it is signed with the private key corresponding to its own public key rather than by a separate certificate authority (CA). It is easy to create, but it is not part of a trusted certificate chain, so browsers and operating systems do not trust it automatically. section 9.1.4 section 9.4
Consider a checkout microservice calling an inventory microservice over HTTPS inside one company. A self-signed certificate may avoid a public CA, but clients commonly show warnings or reject it. Disabling validation with curl, kubectl, or application code removes the protection TLS is meant to provide and can allow insecure behavior to reach production. section 9.1.4 section 9.2
Creating one with OpenSSL
A certificate can be created from a certificate-signing request and its existing private key: openssl x509 -req -days 365 -in request.csr -signkey private_key.pem -out certificate.pem. The command produces a certificate, but clients still need an explicit trust arrangement before accepting it. section 9.1.4
Prefer these patterns when choosing between convenience and trust:
- Use a self-signed certificate only for limited testing where trust is configured deliberately. section 9.3
- For local development, create a personal or private CA, install its CA certificate in the operating system trust store, and issue development certificates from it. section 9.2 section 9.4
- Do not solve certificate errors by turning off validation; preserve the same HTTPS and TLS behavior used in production. section 9.2 section 9.3
$ openssl x509 -req -days 365 -in request.csr -signkey private_key.pem -out certificate.pem
View the complete OpenSSL command used to sign a certificate with its own private key. section 9.1.4
