Generate certificates, CSRs and PFX files in your browser

Fill in a subject and hostnames, pick a key type and a profile, and PKIScope creates a self-signed or CA-signed certificate, a CSR, or a password-protected PFX file. Start from scratch or re-issue from an existing PFX with every field pre-filled. Keys are generated locally and never leave your browser.

What you can do

• Self-signed certificates, CA-signed certificates and CSRs
• RSA 2048–4096, ECDSA P-256/P-384/P-521 and Ed25519 keys
• Profiles for TLS server and client, code signing, document signing, S/MIME email and CA certificates
• Subject Alternative Names for DNS names, IP addresses, emails and URIs
• Re-issue from an existing PFX or certificate with all fields pre-filled
• PFX output in modern AES-256 or Windows-compatible 3DES mode
• Pre-flight checks that warn about settings browsers or CAs reject

Frequently asked questions

Is it safe to generate a private key in the browser?

Keys are created with the browser's WebCrypto API on your device and are never sent anywhere. For production CAs, use a hardware security module.

Which PFX mode should I choose?

Modern mode (AES-256, PBKDF2-SHA256) works with OpenSSL 3, recent Windows and Java. Choose compatible mode (3DES) for older Windows, macOS Keychain or legacy Java.

Can I renew a certificate from my existing PFX?

Yes. Open the PFX, choose “Generate new PFX from this”, change the fields you need, and download a new PFX with a fresh validity period.

Related tools

• Viewer — Inspect and debug certificates, PFX files, keys, CSRs and CRLs
• Private CA — Create a root and intermediate CA, issue and revoke certificates, sign CRLs
• PEM to PFX — Combine certificate, key and chain into a PFX/P12
• Certificate diff — Compare two certificates field by field before you deploy a renewal