🛠️ 自定义证书制作工具Custom Certificate Generator

在浏览器本地生成证书，不上传任何服务器，关掉页面即无痕。两种模式：Certificates are generated locally in your browser — nothing is uploaded, and closing the page leaves no trace. Two modes: 一键成套One-click set（一个 CA + 服务端证书 + 客户端证书，适合设备联调、内网系统测试）和 (one CA + a server certificate + a client certificate — for device integration and internal-system testing) and 单张自定义Single custom（自签，或用你已有的 CA 签发）。生成后可下载 PEM / DER / PFX，并可回 (self-signed, or issued by your own CA). Download PEM / DER / PFX, then verify the result in the 证书查看器certificate viewer 验一遍。.

兼容性设计（新老版本、所有平台）：只用 RSA 密钥（默认 2048 位）+ SHA-256 签名——Windows / Linux / macOS / 安卓 / iOS 和老式嵌入式设备都认；只用 X.509 v3 标准扩展并按规范设置关键标记；生效时间自动提前 1 天，容忍设备时钟偏差；到期时间如越过 2038 年会给出提醒（老系统 32 位时间戳上限）；PEM 为标准 64 字符换行，另提供 DER 二进制和老式 PFX（SHA-1 MAC）导出。Compatibility by design (old and new, every platform): RSA keys only (2048-bit by default) with SHA-256 signatures — accepted by Windows / Linux / macOS / Android / iOS and legacy embedded devices; only standard X.509 v3 extensions with RFC-conformant critical flags; validity starts one day early to tolerate device clock skew; private keys export as traditional PKCS#1 PEM and PFX uses the widely supported legacy-friendly profile, so old and new systems can all import them.

模式一：一键成套（CA + 服务端 + 客户端）Mode 1: One-click set (CA + server + client)

默认已按「设备连中央站」的典型场景填好，改成你的参数即可。Defaults follow the typical device-to-central-station setup — just change the values to yours.

CA 名称（CN）CA name (CN) 组织 O（可空）Organization O (optional) 国家 C（可空，2 个字母）Country C (optional, 2 letters) 服务端域名 SAN（DNS）Server domain SAN (DNS) 服务端 IP SAN（可空）Server IP SAN (optional) 服务端证书 CNServer certificate CN 客户端证书 CNClient certificate CN 密钥长度Key size CA 有效期（天）Validity (days)CA validity (days) 服务端/客户端有效期（天）Server/client validity (days) PFX / P12 密码PFX / P12 password 私钥 .key 密码（可空，留空不加密）Private key (.key) password (optional, blank = unencrypted)

两个密码都在点下载时按表单里当前填的值实时生效：证书生成完之后再改密码、再点下载即可，不用重新生成。私钥密码只影响 .key 文件（下载、整套 zip、PEM 预览）。Both passwords are read from the form at the moment you click download — generate first, change the passwords afterwards, then download; no need to regenerate. The key password only affects .key files (downloads, the full-set zip and the PEM preview).

模式二：单张自定义证书Mode 2: Single custom certificate

通用名 CNCommon name CN 组织 O（可空）部门 OU（可空）Department OU (optional) 国家 C（可空）省/州 ST（可空）State ST (optional) 城市 L（可空）City L (optional) SAN 域名（多个用逗号隔开，可空）SAN domains (comma-separated, optional) SAN IP（多个用逗号隔开，可空）SAN IPs (comma-separated, optional) 证书用途Certificate purpose 密钥长度有效期（天） PFX / P12 密码PFX / P12 password 私钥 .key 密码（可空，留空不加密）Private key (.key) password (optional, blank = unencrypted)

两个密码都在点下载时按表单里当前填的值实时生效：证书生成完之后再改密码、再点下载即可，不用重新生成。私钥密码只影响 .key 文件和 PEM 预览。Both passwords are read from the form at the moment you click download — generate first, change the passwords afterwards, then download; no need to regenerate. The key password only affects the .key file and the PEM preview.

签发方式：Issuance:

自签名（自己签自己）Self-signed (signs itself) 用已有 CA 签发（上传 CA 证书 + CA 私钥）Issue with an existing CA (upload CA certificate + CA private key)

说明Notes

本工具生成的都是自签名体系的测试/内网证书，公网浏览器不会信任，适合设备联调、内网系统、开发测试。生产环境请使用正规 CA 签发的证书。私钥只在你本地生成和下载，务必妥善保管，不要外发。生成后建议把证书拖回查看器复核一遍 SAN、用途和有效期再部署。Certificates made here belong to a self-signed test/internal PKI. Public browsers will not trust them; they are meant for device integration, internal systems and development testing. For production, use certificates from a real CA. Private keys are generated and downloaded only on your machine — keep them safe and never share them. After generating, drop the certificate into the viewer to double-check the SAN, usages and validity before deploying.