Security & SSL
Self-Signed Certificate
A self-signed certificate is signed by its own private key rather than a trusted Certificate Authority (CA). While technically providing encryption, self-signed certificates are not trusted by browsers or operating systems because there's no third-party verification of the server's identity. This makes them unsuitable for production websites.
Symptoms
- Browser warning "Your connection is not private" or "NET::ERR_CERT_AUTHORITY_INVALID"
- API clients throwing "unable to get local issuer certificate" errors
- Users required to manually accept security exceptions
- Mobile apps refusing to connect to the server
Common Causes
- Development/testing certificate deployed to production
- Certificate generated with openssl without CA signing
- Internal CA certificate not distributed to client trust stores
- Free CA alternatives (Let's Encrypt) not considered
Step-by-Step Troubleshooting
- 1
Verify certificate issuer
Check if the certificate is issued by a recognized CA or is self-signed.
Use SSL Certificate Check → - 2
Obtain a CA-signed certificate
Use Let's Encrypt (free) or a commercial CA to get a trusted certificate.
- 3
Install the trusted certificate
Replace the self-signed certificate with the CA-issued certificate on your server.
- 4
Verify the new certificate
Confirm the new certificate is trusted and the chain is complete.
Use SSL Certificate Check →
Recommended Diagnostic Tools
Monitor Certificate Trust
Detect self-signed or untrusted certificates automatically.