ssl-gen-cli

Generate self-signed SSL certificates for local development — fast, zero config.

Features

• Self-signed cert + key pair generation
• Custom domain/CN (--domain)
• Custom validity days (--days)
• Subject Alternative Names / SANs (--san)
• Custom output directory (--output)
• PKCS12/PFX export (--pfx)
• RSA key size: 2048 or 4096 (--key-size)
• Local CA generation + signing (--ca, ca subcommand)
• Certificate info display (info subcommand)
• OS-specific trust instructions

Requirements

• Node.js ≥ 18
• openssl available in PATH

Installation

npm install -g ssl-gen-cli

Or run directly:

npx ssl-gen-cli generate --domain myapp.local

Usage

Generate a certificate

# Quickstart — localhost self-signed
ssl-gen-cli generate

# Custom domain
ssl-gen-cli generate --domain myapp.local

# With local CA (recommended for browsers)
ssl-gen-cli generate --domain myapp.local --ca

# Multiple SANs
ssl-gen-cli generate --domain myapp.local \
  --san api.local --san admin.local --san 192.168.1.10

# 2-year cert with 4096-bit key
ssl-gen-cli generate --domain myapp.local --days 730 --key-size 4096

# Export PFX bundle (e.g. for IIS / .NET)
ssl-gen-cli generate --domain myapp.local --pfx --pfx-password mypass

# Custom output directory
ssl-gen-cli generate --domain myapp.local --output ./ssl/certs

# Sign with an existing CA
ssl-gen-cli generate --domain myapp.local \
  --ca-key ./ca/ca.key --ca-cert ./ca/ca.crt

Generate a CA only

ssl-gen-cli ca --output ./ca --days 3650

Show certificate info

ssl-gen-cli info ./certs/myapp.local.crt

Print trust instructions for a CA

ssl-gen-cli trust ./certs/ca.crt

Options (generate)

| Flag | Default | Description | |------|---------|-------------| | -d, --domain <domain> | localhost | Primary domain / CN | | --days <number> | 365 | Validity in days | | -s, --san <name...> | — | Extra SANs (domain or IP) | | -o, --output <dir> | ./certs | Output directory | | --pfx | false | Export PKCS12/PFX bundle | | --pfx-password <pass> | changeit | PFX password | | --key-size <bits> | 2048 | RSA key size (2048 or 4096) | | --ca | false | Generate local CA and sign with it | | --ca-key <path> | — | Existing CA key to sign with | | --ca-cert <path> | — | Existing CA cert to sign with |

Output Files

| File | Description | |------|-------------| | <domain>.key | Private key (chmod 600) | | <domain>.crt | Certificate | | <domain>.csr | CSR (only when signing with CA) | | <domain>.p12 | PKCS12 bundle (when --pfx) | | ca.key | CA private key (when --ca) | | ca.crt | CA certificate (when --ca) |

Trusting the CA Certificate

After generating with --ca:

Ubuntu/Debian:

sudo cp ./certs/ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

RHEL/Fedora:

sudo cp ./certs/ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

macOS:

sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain ./certs/ca.crt

Windows (Admin PowerShell):

certutil -addstore -f "ROOT" .\certs\ca.crt

Firefox: Settings → Privacy & Security → View Certificates → Authorities → Import

License

MIT