All tools

X.509 Cert & CSR Generator

Generate self-signed X.509 certificates and CSRs for SAML SSO, mTLS, and local HTTPS testing.

Crypto & Certs
Privacy: 100% Client-Side. Your data never leaves this browser tab. Processing uses Web APIs and client-side libraries only.

Generate self-signed X.509 certificates and PKCS#10 CSRs for SAML SSO, local HTTPS / mTLS, and CA submission. Keys stay in this browser tab.

One-click presets

Distinguished Name (DN)

One per line: DNS:, IP:, EMAIL:, or URL:

Why generate X.509 certs in the browser?

SAML IdPs/SPs, local HTTPS, and mTLS microservices all need signing certificates or CSRs. The usual path is a long openssl req -x509 -newkey … invocation, plus careful handling of private keys and Subject Alternative Names.

stbox's generator creates RSA or ECDSA key pairs with WebCrypto, builds self-signed certificates or PKCS#10 CSRs with @peculiar/x509, and can export PKCS#12 bundles for RSA — all without leaving your tab.

How to use this tool

  1. Pick a preset (SAML SSO, mTLS/localhost, or CSR) or configure DN, SANs, key type, and validity manually.
  2. Click Generate — copy or download the .crt/.pem, .key, .csr, or .p12 outputs.
  3. Paste the certificate into your IdP/SP metadata, local TLS config, or submit the CSR to your CA.

Frequently asked questions

Do private keys leave my browser?

No. Key generation, signing, and export run entirely client-side. stbox servers never receive your private key or certificate material.

What key types are supported?

RSA 2048/4096 and ECDSA P-256/P-384. Private keys export as PKCS#8, or PKCS#1 (RSA PRIVATE KEY) for RSA. PKCS#12 (.p12) export is available for RSA certificates.

Can I add Subject Alternative Names?

Yes. Enter DNS, IP, EMAIL, or URL SANs (one per line) — essential for localhost HTTPS and mTLS testing.