Security Tools › PKI & Certificates › Create & convert

Create and convert

Generate a private key and a PKCS#10 request without installing anything, issue short-lived certificates for .test and .localhost development, and convert between PEM, DER, P7B, Base64 and hex.

3 free tools
Nothing uploaded or stored
PKCS#10 · PEM · DER · P7B

Create & convert

Make keys, PKCS#10 requests and short-lived test certificates, and move between formats.

CSR & key generator PKCS#10 creator ML-DSA

Create a private key and a certificate signing request without installing anything. The key is generated by your browser's own cryptography engine and never leaves this tab.

Common Name

Organization

Department (optional)

City

Province / State

Country (2 letters)

Email (optional)

Key type

Subject Alternative Names — one per line (DNS names, IP addresses or emails)

Also put the Common Name in the SAN list

Requested extensions (optional)

Key Usage: digitalSignature Key Usage: keyEncipherment (RSA only) EKU: TLS server EKU: TLS client Basic Constraints: CA = false

Most CAs decide the final extensions themselves; these only express what you ask for.

ML-DSA keys are saved in the seed form recommended by RFC 9881 and open with OpenSSL 3.5 or later. Prefer to keep keys on your own machine? openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout site.key -out site.csr -subj "/CN=www.yourcompany.ca" -addext "subjectAltName=DNS:www.yourcompany.ca"

Dev certificate lab X.509 issuer for .test · .localhost · .example · .invalid ML-DSA

Get a working HTTPS certificate for local development in seconds. Each run creates a brand-new, one-time root, signs your certificate, and then throws the root's key away.

Reserved names only. Certificates are issued only for names under the reserved test domains .test, .localhost, .example and .invalid (RFC 2606 / RFC 6761), the name localhost, and loopback addresses (127.0.0.0/8, ::1). Real and registered domains are always refused — even for their owners. For a real domain, use a public CA such as Let's Encrypt.

Valid for

Key type (if not using a CSR)

One-time root signs with

Profile

Names — one per line

Use my own CSR instead (keeps your private key on your machine)

Everything happens in your browser. The one-time root is limited by a critical Name Constraints extension to the reserved names above, so even if it is installed, modern clients will not accept it for any real website. Post-quantum (ML-DSA) certificates are for lab testing with OpenSSL 3.5+ and other PQC-capable software; most browsers and public CAs do not support them yet.

Format converter PEM · DER · P7B · base64 · hex

Convert certificates, CSRs, CRLs and public keys between PEM and DER, unpack a .p7b bundle into PEM, or pack several certificates into a .p7b.

Input

or load a file

PKCS#12 (.pfx/.p12) files hold private keys, so we leave those to OpenSSL on your machine: openssl pkcs12 -in file.pfx -nokeys -out certs.pem

Create and convert

Create & convert

CSR & key generator PKCS#10 creator ML-DSA

Dev certificate lab X.509 issuer for .test · .localhost · .example · .invalid ML-DSA

Format converter PEM · DER · P7B · base64 · hex

More free PKI tools