Why do browsers warn about self-signed certificates?

A self-signed certificate has no chain to a trusted Certificate Authority. The browser cannot verify that the public key belongs to the claimed identity. This is correct behavior — for production, use a certificate from a trusted CA (Let's Encrypt, etc.).

What key size should I use for RSA?

2048 bits is the minimum acceptable size today. 4096 bits provides a larger security margin but is slower for key generation and handshake. For new systems, consider ECDSA P-256 which provides equivalent security to 3072-bit RSA at much smaller key sizes.

TASK

Generate RSA key pair and inspect self-signed certificate fields

Create an RSA key pair for testing, and understand the structure of a self-signed X.509 certificate for local development.

1

Self-signed certificates are used for local TLS testing and internal services. They are not trusted by browsers (no CA signature) but the structure is identical to public certificates. Understanding the fields helps debug TLS issues.
2

RSA Tool →
Generate an RSA key pair (2048 or 4096 bits). The tool outputs the public and private keys in PEM format. Use this for local testing only — never for production TLS.
3

UUID / ULID Generator →
Generate a UUID to use as a serial number or unique identifier for the certificate entity.
4

A self-signed X.509 certificate contains: version, serial number, subject (CN, O, OU), issuer (same as subject for self-signed), validity (notBefore/notAfter), public key, and signature. The signature is computed by the subject's own private key, which is why browsers reject it.

Frequently asked questions

Why do browsers warn about self-signed certificates?: A self-signed certificate has no chain to a trusted Certificate Authority. The browser cannot verify that the public key belongs to the claimed identity. This is correct behavior — for production, use a certificate from a trusted CA (Let's Encrypt, etc.).
What key size should I use for RSA?: 2048 bits is the minimum acceptable size today. 4096 bits provides a larger security margin but is slower for key generation and handshake. For new systems, consider ECDSA P-256 which provides equivalent security to 3072-bit RSA at much smaller key sizes.