Erzeugen RSA key pair and inspect self-signed certificate fields
Erstellen ein RSA Schlüssel pair für testing, und understand der Struktur von ein self-signed X.509 certificate für lokal development.
- 1
Self-signed certificates are used for local TLS testing and internal services. They are not trusted by browsers (no CA signature) but the structure is identical to public certificates. Understanding the fields helps debug TLS issues.
- 2 RSA-Tool →
Erzeugen an RSA key pair (2048 or 4096 bits). The tool outputs the public and private keys in PEM format. Use this for local testing only — never for production TLS.
- 3 UUID/ULID-Generator →
Erzeugen a UUID to use as a serial number or unique identifier for the certificate entity.
- 4
A self-signed X.509 certificate contains: version, serial number, subject (CN, O, OU), issuer (same as subject for self-signed), validity (notBefore/notAfter), public key, and signature. The signature is computed by the subject's own private key, which is why browsers reject it.
Häufige Fragen
- Why do browsers warn about self-signed certificates?
- A self-signed certificate has no chain to a trusted Certificate Authority. The browser cannot verify that the public key belongs to the claimed identity. This is correct behavior — for production, use a certificate from a trusted CA (Let's Encrypt, etc.).
- What key size should I use for RSA?
- 2048 bits is the minimum acceptable size today. 4096 bits provides a larger security margin but is slower for key generation and handshake. For new systems, consider ECDSA P-256 which provides equivalent security to 3072-bit RSA at much smaller key sizes.