# Self Signed SSL Certificates **URL:** \ **Category:** Server\ **Created:** [March 19, 2018, 1:05pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992 "2018-03-19T13:05:13Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![mohammed\_max](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mohammed_max/32/27741_2.png) [@mohammed\_max](https://community.letsencrypt.org/u/mohammed_max)\ **Post date:** [March 19, 2018, 1:05pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/1 "2018-03-19T13:05:13Z")
hi How to create Self Signed SSL Certificates for HTTPS from in my Apache2.4.29 and openssl1.1.0g -Does the international ban affect the Self signature? -i am in sudanes I have tried several times and will not succeed i need to steps 1.2.3…4… and Command-Line Please can you help me ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [March 19, 2018, 1:09pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/2 "2018-03-19T13:09:33Z")
Hi, Although this is off-topic, but here you go: [https://jamielinux.com/docs/openssl-certificate-authority](https://jamielinux.com/docs/openssl-certificate-authority) Create a self-signed tls certificate doesn’t involve any ban since it’s not a public ca. Thank you ---
**Author:** ![mohammed\_max](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mohammed_max/32/27741_2.png) [@mohammed\_max](https://community.letsencrypt.org/u/mohammed_max)\ **Post date:** [March 19, 2018, 1:13pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/3 "2018-03-19T13:13:51Z")
Thank But applied all the orders competent to sign Self but not useful ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [March 19, 2018, 1:17pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/4 "2018-03-19T13:17:47Z")
If this is the case, what are you trying to do exactly? Thank you ---
**Author:** ![mohammed\_max](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mohammed_max/32/27741_2.png) [@mohammed\_max](https://community.letsencrypt.org/u/mohammed_max)\ **Post date:** [March 19, 2018, 1:31pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/5 "2018-03-19T13:31:35Z")
> [@stevenzhu](#): > > If this is the case, what are you trying to do exactly? > > Thank you I have the task of creating a small site in a local server and secure it OpenSSL ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 19, 2018, 1:33pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/6 "2018-03-19T13:33:40Z")
From personal experience, I can tell you the how-to linked above by @stevenzhu ([OpenSSL Certificate Authority — Jamie Nguyen](https://jamielinux.com/docs/openssl-certificate-authority/)) works very well. If you somehow can't make it work, you'll need to tell us _ **exactly** _ why it doesn't work: which command did you type, what output did it generate and in what way is that different from what you expected. Also: > [@mohammed\_max](#): > > -Does the international ban affect the Self signature? Let's Encrypt does issue publically valid certificates for Sudan: [https://crt.sh/?Identity=%25.sd&iCAID=16418](https://crt.sh/?Identity=%25.sd&iCAID=16418) Also note this forum is for the Let's Encrypt community. As far as I know, it's _not_ intended to be a general "SSL" or "TLS" help forum, if it doesn't have anything to do with Let's Encrypt. There is a grey area of course when people with Let's Encrypt certificates in place ask about TLS stuff not directly related to the certificate itself.. ---
**Author:** ![mohammed\_max](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mohammed_max/32/27741_2.png) [@mohammed\_max](https://community.letsencrypt.org/u/mohammed_max)\ **Post date:** [March 19, 2018, 1:41pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/7 "2018-03-19T13:41:20Z")
Microsoft Windows [Version 6.1.7601] Copyright © 2009 Microsoft Corporation. All rights reserved. C:\Users\mohammedz\>cd C:\Apache24\conf C:\Apache24\conf\>httpd ’httpd’ is not recognized as an internal or external command, operable program or batch file. C:\Apache24\conf\>httpd ’httpd’ is not recognized as an internal or external command, operable program or batch file. C:\Apache24\conf\>cd … C:\Apache24\>cd bin C:\Apache24\bin\>httpd AH00526: Syntax error on line 144 of C:/Apache24/conf/extra/httpd-ssl.conf: SSLCertificateFile: file ‘C:/Apache24/conf/server.crt’ does not exist or is empt y C:\Apache24\bin\>httpd AH00526: Syntax error on line 144 of C:/Apache24/conf/extra/httpd-ssl.conf: SSLCertificateFile: file ‘C:/Apache24/conf/server.crt’ does not exist or is empt y C:\Apache24\bin\>httpd (OS 10048)Only one usage of each socket address (protocol/network address/port) is normally permitted. : AH00072: make\_sock: could not bind to address [::]:80 (OS 10048)Only one usage of each socket address (protocol/network address/port) is normally permitted. : AH00072: make\_sock: could not bind to address 0.0.0.0: 80 AH00451: no listening sockets available, shutting down AH00015: Unable to open logs C:\Apache24\bin\>httpd (OS 10048)Only one usage of each socket address (protocol/network address/port) is normally permitted. : AH00072: make\_sock: could not bind to address [::]:80 (OS 10048)Only one usage of each socket address (protocol/network address/port) is normally permitted. : AH00072: make\_sock: could not bind to address 0.0.0.0: 80 AH00451: no listening sockets available, shutting down AH00015: Unable to open logs C:\Apache24\bin\>httpd (OS 10048)Only one usage of each socket address (protocol/network address/port) is normally permitted. : AH00072: make\_sock: could not bind to address [::]:80 (OS 10048)Only one usage of each socket address (protocol/network address/port) is normally permitted. : AH00072: make\_sock: could not bind to address 0.0.0.0: 80 AH00451: no listening sockets available, shutting down AH00015: Unable to open logs C:\Apache24\bin\> ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 19, 2018, 1:44pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/8 "2018-03-19T13:44:01Z")
I have no idea what you’re trying to do, but the “linux” part from the domain name of the how-to might give you a hint. I have no idea on how to get OpenSSL working on a Windows machine. ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [March 19, 2018, 1:45pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/9 "2018-03-19T13:45:38Z")
Hi, Can you please explain what are you trying to do? DID you created the certificates already and just trying to install it? Or you haven’t created it yet?? ---
**Author:** ![mohammed\_max](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mohammed_max/32/27741_2.png) [@mohammed\_max](https://community.letsencrypt.org/u/mohammed_max)\ **Post date:** [March 19, 2018, 1:46pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/10 "2018-03-19T13:46:19Z")
Thank you my bro:smiley: ---
**Author:** ![mohammed\_max](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mohammed_max/32/27741_2.png) [@mohammed\_max](https://community.letsencrypt.org/u/mohammed_max)\ **Post date:** [March 19, 2018, 1:50pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/11 "2018-03-19T13:50:54Z")
yes… i created the certificates but do not work ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [March 19, 2018, 6:32pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/12 "2018-03-19T18:32:37Z")
Hi @mohammed_max, It’s expected that when you create a self-signed certificate, it will be rejected by your browser or most other applications, because the certificate is not signed by a trusted authority (like Let’s Encrypt). If this is a server for your own use, you may want to add an exception for the particular self-signed certificate. You can do this in Firefox, for instance. When you load the page, you will see an option to “Add Exception…”. Are you trying to create a publicly accessible site, or just a site for your own personal use? If you are creating a publicly accessible site, you will need a publicly trusted certificate. For instance you can get one from Let’s Encrypt using [https://letsencrypt.org/getting-started/](https://letsencrypt.org/getting-started/). If that doesn’t solve your problem, please provide more details about what you did and in what way it doesn’t work. Screenshots would be helpful! ---
**Author:** ![mohammed\_max](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mohammed_max/32/27741_2.png) [@mohammed\_max](https://community.letsencrypt.org/u/mohammed_max)\ **Post date:** [March 20, 2018, 8:24am UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/13 "2018-03-20T08:24:32Z")
this is command C:\Apache24\bin\>openssl genpkey -algorithm RSA -pkeyopt rsa\_keygen\_bits:2048 -ou t sd.key …+++ …+++ C:\Apache24\bin\>openssl req -new -x509 -days 360 -key sd.key -subj “/CN=test CA/ 0=AAAA test organization” -out sd.crt req: Skipping unknown attribute “0” C:\Apache24\bin\>openssl genpkey -algorithm RSA -pkeyopt rsa\_keygen\_bits:2048 -ou t server.key …+++ …+++ C:\Apache24\bin\>openssl req -new -key server.key -subj “/CN=localhost CA/0=AAAA test organization” -out server.csr req: Skipping unknown attribute “0” C:\Apache24\bin\>openssl x509 -days 360 -req -in server.csr -CAcreateserial -CA s d.crt -CAkey sd.key -out server.csr 10108:error:0906D06C:PEM routines:PEM\_read\_bio:no start line:crypto\pem\pem\_lib. c:691:Expecting: CERTIFICATE REQUEST C:\Apache24\bin\>openssl genpkey -algorithm RSA -pkeyopt rsa\_keygen\_bits:2048 -ou t client.key … …+++ …+++ C:\Apache24\bin\>openssl req -new -key client.key -subj “/CN=Test User/0=AAAA Tes t organization/UID=testuser1” -out client.crt req: Skipping unknown attribute “0” C:\Apache24\bin\>openssl x509 -days 360 -req -n client.csr -CAcreateserial -CA sd .crt -CAkey sd.key -out client.crt x509: Unknown digest n x509: Use -help for summary. C:\Apache24\bin\>openssl pkcs12 -in client.crt -inkey client.key -export -passwor d pass: -out client.p12 unable to load certificates C:\Apache24\bin\> ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [March 20, 2018, 9:17am UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/14 "2018-03-20T09:17:02Z")
> [@mohammed\_max](#): > > req: Skipping unknown attribute “0” I'm pretty sure this should be the letter O, not the number 0. ---
**Author:** ![mohammed\_max](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mohammed_max/32/27741_2.png) [@mohammed\_max](https://community.letsencrypt.org/u/mohammed_max)\ **Post date:** [March 20, 2018, 9:30am UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/15 "2018-03-20T09:30:47Z")
Thank again I will try ---
**Author:** ![mohammed\_max](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mohammed_max/32/27741_2.png) [@mohammed\_max](https://community.letsencrypt.org/u/mohammed_max)\ **Post date:** [March 20, 2018, 9:37am UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/16 "2018-03-20T09:37:59Z")
Your expectation was correct but there is another mistake Look C:\Apache24\bin\>openssl req -new -key server.key -subj “/CN=localhost CA/O=AAAA test organization” -out server.csr C:\Apache24\bin\>openssl x509 -days 360 -req -in server.csr -CAcreateserial -CA s d.crt -CAkey sd.key -out server.csr 7884:error:0906D06C:PEM routines:PEM\_read\_bio:no start line:crypto\pem\pem\_lib.c :691:Expecting: CERTIFICATE REQUEST ---
**Author:** ![mohammed\_max](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mohammed_max/32/27741_2.png) [@mohammed\_max](https://community.letsencrypt.org/u/mohammed_max)\ **Post date:** [March 20, 2018, 9:52am UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/17 "2018-03-20T09:52:13Z")
I’ve found it I’ve been wrong in stretch(.csr) He’s wrong -out server.csr that is right -out server.crt ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 20, 2018, 7:39pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/18 "2018-03-20T19:39:05Z")
Hi @mohammed_max, Can you please explain again why you are creating a self-signed certificate and what you expect to use this certificate for? As @jsha described before, self-signed certificates will _always_ produce a browser error in each new browser that encounters them, because the browser has no way of knowing if the information in the self-signed certificate is really correct or not (because anyone in the world can always create a self-signed certificate containing any information of their choice). ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [March 20, 2018, 7:59pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/19 "2018-03-20T19:59:53Z")
> [@schoen](#): > > Can you please explain again why you are creating a self-signed certificate and what you expect to use this certificate for? ...and why you're asking about it here? ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 20, 2018, 9:08pm UTC](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992/20 "2018-03-20T21:08:14Z")
I will mention again (which I think other users have already said) that although most certificate authorities are not willing to issue publicly-trusted certificates to users in the Sudan, or have trouble accepting payments from Sudanese customers, Let’s Encrypt does _not_ block or forbid most users in the Sudan from obtaining certificates. In fact, there are already about 2,000 Let’s Encrypt certificates issued to users with `.sd` domain names [https://crt.sh/?Identity=%.sd&iCAID=16418](https://crt.sh/?Identity=%25.sd&iCAID=16418) So, if you have any application that could benefit from a publicly-trusted certificate, you can probably get one from Let’s Encrypt for free. (In that case you would probably want to use a Let’s Encrypt client application rather than a series `openssl` commands.) [Next page](https://community.letsencrypt.org/t/self-signed-ssl-certificates/56992.md?page=2)