Question 1

How do I create a self-signed certificate for localhost?

Accepted Answer

Set the Common Name (and a DNS SAN) to 'localhost', add 127.0.0.1 as an IP SAN, then generate. You'll get key.pem, cert.pem and fullchain.pem to point your dev server at.

Question 2

Why does my browser still warn about the certificate?

Accepted Answer

Self-signed certificates aren't in the browser's trust store. Add the certificate (or your generated CA) to your OS/browser trusted roots to remove the warning. For public production sites, use a real CA like Let's Encrypt.

Question 3

What are Subject Alternative Names (SANs)?

Accepted Answer

SANs list every hostname and IP a certificate is valid for. Modern browsers validate the hostname against the SANs, not the Common Name, so a server certificate must include each domain/IP as a SAN.

Question 4

Can I create a local Certificate Authority like mkcert?

Accepted Answer

Yes. Tick 'Issue from a new local CA' and the tool creates a root CA plus a leaf certificate signed by it. Trust rootCA.pem once in your OS/browser and every certificate the CA issues is trusted — no per-certificate warnings.

Question 5

Does it support ECDSA and Ed25519 certificates?

Accepted Answer

Yes. Choose RSA for maximum compatibility, or ECDSA (P-256/384/521) and Ed25519 for smaller, faster modern TLS. All are generated and signed locally via the Web Crypto API.