selfsigned

Provide a passphrase in the options to encrypt the generated private key using AES-256-CBC. The resulting private key will be in encrypted PKCS#8 format (-----BEGIN ENCRYPTED PRIVATE KEY-----).

To use the encrypted key with Node.js https or crypto, you must provide the passphrase during decryption or server setup.

const https = require('https');

// Use directly with HTTPS server
https.createServer({
  key: pems.private,
  passphrase: 'my-secret-passphrase',
  cert: pems.cert
}, app).listen(443);

To generate certificates that are trusted by a specific Certificate Authority (e.g., for local development with mkcert), provide the CA's key and certificate in the ca option.

const fs = require('fs');
const selfsigned = require('selfsigned');

const pems = await selfsigned.generate([
  { name: 'commonName', value: 'localhost' }
], {
  algorithm: 'sha256',
  ca: {
    key: fs.readFileSync('/path/to/ca.key', 'utf8'),
    cert: fs.readFileSync('/path/to/ca.crt', 'utf8')
  }
});

Install the selfsigned package using npm to generate self-signed X.509 certificates using Node.js native crypto.

npm install selfsigned

Control the certificate's lifespan using notBeforeDate and notAfterDate in the options object.

// Valid for 30 days using date-fns
const { addDays } = require('date-fns');
const pems = await selfsigned.generate(null, {
  notBeforeDate: new Date(),
  notAfterDate: addDays(new Date(), 30)
});

// Valid for 2 years using vanilla JS
const notBefore = new Date();
const notAfter = new Date(notBefore);
notAfter.setFullYear(notAfter.getFullYear() + 2);

const pems2 = await selfsigned.generate(null, {
  notBeforeDate: notBefore,
  notAfterDate: notAfter
});

To use Elliptic Curve cryptography instead of the default RSA, set keyType: 'ec' in the options. You can specify the curve using the curve option.

Supported Curves:

• P-256 (default): 128-bit security, fastest.
• P-384: 192-bit security.
• P-521: 256-bit security, strongest.

// Default P-256 curve
const pems = await selfsigned.generate(null, { keyType: 'ec' });

// P-384 curve
const pems2 = await selfsigned.generate(null, { keyType: 'ec', curve: 'P-384' });

// P-521 curve with SHA-512
const pems3 = await selfsigned.generate(null, {
  keyType: 'ec',
  curve: 'P-521',
  algorithm: 'sha512'
});

In version 5.0+, the generate() function is asynchronous and returns a Promise. You must provide an array of attributes (following X.509 standards) to define the certificate subject.

Output Format: The resolved Promise returns an object containing the PEM-encoded keys and certificate:

{
  "private": "-----BEGIN PRIVATE KEY-----\n...",
  "public": "-----BEGIN PUBLIC KEY-----\n...",
  "cert": "-----BEGIN CERTIFICATE-----\n...",
  "fingerprint": "XX:XX:XX:..."
}

const selfsigned = require('selfsigned');

const attrs = [{ name: 'commonName', value: 'contoso.com' }];
const pems = await selfsigned.generate(attrs);
console.log(pems);

To generate certificates in PKCS#7 format, use the createPkcs7 function from the selfsigned/pkcs7 module. This is provided as a separate module to allow for better tree-shaking in your applications.

You can use it for standard certificates or specifically for client certificates by setting the clientCertificate: true option in the generate call.

const selfsigned = require('selfsigned');
const { createPkcs7 } = require('selfsigned/pkcs7');

// Standard certificate PKCS#7
const pems = await selfsigned.generate(attrs);
const pkcs7 = createPkcs7(pems.cert);
console.log(pkcs7); // PKCS#7 formatted certificate

// Client certificate PKCS#7
const pemsClient = await selfsigned.generate(null, { clientCertificate: true });
const clientPkcs7 = createPkcs7(pemsClient.clientcert);

Instead of generating a new key pair, you can provide your own existing keys using the keyPair option.

const pems = await selfsigned.generate(null, {
  keyPair: {
    publicKey: '-----BEGIN PUBLIC KEY-----...',
    privateKey: '-----BEGIN PRIVATE KEY-----...'
  }
});