How to Obtain a Self-Signed Certificate for Development on Raspberry Pi

When we are doing development and testing tasks, we often need to use HTTPS to verify that everything works correctly.

For this, we don’t need a “real” SSL certificate. For our tests, a self-signed SSL certificate can be more than enough. (in fact, it’s a very common tool in development).

Self-signed SSL certificates are not validated by a certificate authority. In fact, most browsers will show a warning (and rightly so).

But they are useful for internal tests and local development (not for production environments), where we need to test that something works with HTTPS.

So let’s see how to obtain and configure a self-signed SSL certificate on a Linux machine like a Raspberry Pi.

Prepare Your Raspberry Pi

First, we make sure our Raspberry Pi is up to date.

It must also have the necessary web server installed. For this tutorial, we will use Apache or Nginx interchangeably.

Generate the Self-Signed SSL Certificate

Now, we are going to install OpenSSL, a key tool for generating self-signed certificates.

We will use OpenSSL to create the self-signed certificate. In this process, two files will be generated:

First, create a directory for the certificates.

Now, generate the private key and the certificate. The following command creates a 2048-bit private key and a self-signed certificate valid for one year:

During this process, you will be asked to enter some details, such as country, state, city, organization name, etc. These details will be incorporated into the certificate.

Configure the Server to Use the Certificate

SSLEngine on
SSLCertificateFile /etc/ssl/certs/selfsigned.crt
SSLCertificateKeyFile /etc/ssl/private/selfsigned.key

server {
   listen 443 ssl;
   server_name example.local;

   ssl_certificate /etc/ssl/certs/selfsigned.crt;
   ssl_certificate_key /etc/ssl/private/selfsigned.key;

   location / {
       root /var/www/html;
       index index.html index.htm;
   }
}

server {
   listen 80;
   server_name example.local;

   return 301 https://$host$request_uri;
}

Verify the Installation

Now, let’s check that everything is working correctly. Open a web browser and go to https://<your_ip_or_domain>.

You should see the lock 🔒 in the address bar, but with a security warning informing you that the certificate is not validated by a certificate authority.

This is normal for a self-signed certificate (we already anticipated this earlier). If you see the lock, everything is fine.