Self-Signed Certificates: What They Are and When to Avoid Them

A self-signed certificate is signed by the same entity that created it, rather than by a recognized certificate authority.

Why Browsers Warn About Them

Since there's no trusted third party vouching for it, browsers can't verify a self-signed certificate's legitimacy, and display a security warning by default.

When They're Actually Fine

Internal development environments, testing setups, and private networks not accessed by the public are all reasonable uses, since the people accessing them can knowingly accept the warning.

Never Use Them for a Public Website

For any site real visitors reach, use a properly issued certificate (free options like Let's Encrypt remove any cost excuse) — the security warning alone will drive away nearly all legitimate visitors.

Further Reading

• SSL Certificates
• More Cybersecurity Guides
• Let's Encrypt