A self-signed certificate is a digital credential that a person or organization creates and signs themselves, rather than buying one from a trusted certificate authority
When you visit a website, your browser checks whether the site's security certificate was issued by a company that browsers trust — like DigiCert, Let's Encrypt, or Sectigo. A self-signed certificate skips that middle step. The website owner generates the certificate on their own computer, signs it with their own key, and installs it on their server. Your browser has no way to verify that the certificate actually came from who claims to own it.
This creates a real security problem for everyday internet use. A hacker could create a self-signed certificate for "amazon.com" or "your-bank.com" and use it to intercept your traffic. Your browser would show a warning — usually a red screen or a "not find" message — but many people click through warnings without reading them. Self-signed certificates are useful for specific technical situations, but they should not be the only security layer protecting sensitive data.
Key Takeaways
- A self-signed certificate is created and signed by the website owner, not by a trusted company, so browsers cannot verify who actually owns the site.
- Your browser will display a warning when you visit a site with a self-signed certificate, because it cannot confirm the certificate is legitimate.
- Self-signed certificates do encrypt your connection, but they do not protect you from someone impersonating the website.
- Legitimate companies use certificates from trusted authorities; self-signed certificates on a banking or shopping site are a red flag.
- Self-signed certificates are appropriate for internal company networks, testing environments, and personal projects where you control both ends of the connection.
How a self-signed certificate differs from a trusted one
A certificate from a trusted authority like Let's Encrypt or DigiCert includes a chain of verification. The certificate authority checks that you actually own the domain before issuing the certificate. They sign it with their own key, which is built into your browser. When you visit the site, your browser verifies the signature using the authority's key — proof that the certificate came from someone trustworthy.
A self-signed certificate has no chain. The website owner creates it, signs it with their own key, and that is the end of the verification. Your browser has never heard of that key before. It cannot confirm that the person who created the certificate actually owns the domain or has any right to represent the organization. The encryption still works — your data is scrambled in transit — but you have no proof you are talking to the real website.
What the browser warning actually means
When you land on a site with a self-signed certificate, your browser shows a warning. In Chrome, Firefox, and Safari, this is usually a red screen saying "Your connection is not private" or "This site can't be reached." The message is not wrong. Your connection is encrypted, but your browser cannot verify the site is who it claims to be.
Some people interpret this warning as "the site is unsafe" and leave when ready. Others think it means "the site is just being cautious" and click through. The truth is more specific: the site might be exactly what it claims, or it might be a fake. You have no way to tell from the certificate alone. If you are logging into a bank account or entering a credit card number, a self-signed certificate on a public website is a reason to stop and verify the URL in another way — call the company, check their official app, or visit from a different device.
When self-signed certificates are actually appropriate
Self-signed certificates make sense in closed environments where you control both ends of the connection. A company might use one on an internal network that employees access from inside the office or through a VPN. The IT team creates the certificate, installs it on the server, and distributes the certificate file to employee computers. Everyone on the network knows the certificate is legitimate because they got it from their own IT department.
Developers also use self-signed certificates when testing code on their own machines before deploying to production. A certificate authority would be pointless here — you are the only person accessing the test site. The same applies to personal projects, hobby servers, or anything that runs on your local network. The warning your browser shows is expected and harmless.
The key difference is audience. If only people you know and trust will visit the site, and they know to expect a self-signed certificate, it is fine. If strangers on the internet will visit — a bank, a store, a social media site, anything public — a self-signed certificate is a liability.
Why legitimate organizations do not use self-signed certificates
A trusted certificate costs money, though not much. Let's Encrypt offers free certificates to anyone who owns a domain. Paid certificates from other authorities cost between $50 and $300 per year. For a business handling customer data, this is a trivial expense compared to the cost of a data breach or lost customer trust.
More importantly, a trusted certificate is a legal commitment. The certificate authority has checked that you own the domain and that you are who you claim to be. If you misuse the certificate — for example, to impersonate a bank — the authority can revoke it and report you. This creates accountability. A self-signed certificate creates no accountability. Anyone can create one for any domain name.
If you see a self-signed certificate on a site that claims to be a bank, a payment processor, a government agency, or any organization handling sensitive information, that is a strong signal something is wrong. Either the site is fake, or the organization is incompetent about security. Either way, do not enter personal information.
What encryption a self-signed certificate actually provides
A self-signed certificate does encrypt your connection using the same algorithms as a trusted certificate. The data you send is scrambled so that someone watching your network traffic cannot read it. This protects you against casual eavesdropping — someone on your WiFi network cannot see your passwords or messages.
What it does not protect you against is impersonation. If a hacker intercepts your connection and presents their own self-signed certificate for "your-bank.com," your browser will show a warning. But if you are in a hurry, or if the hacker has set up the fake site to look identical to the real one, you might click through the warning and enter your login credentials. The hacker now has your username and password, even though the connection was encrypted.
A trusted certificate prevents this. Your browser verifies that the certificate for "your-bank.com" was issued to the actual bank, not to a hacker. If the hacker tries to use a self-signed certificate or a certificate for a different domain, your browser blocks the connection entirely — no warning, no option to proceed.
How to check whether a certificate is self-signed
In most browsers, you can click the lock icon next to the URL to see certificate details. In Chrome, click the lock, then click "Certificate is not valid" or the certificate name. A window opens showing who issued the certificate. If the "Issued by" field shows the same name as the "Issued to" field, or if it says something like "Self-signed," the certificate is self-signed.
You can also look at the browser warning itself. Chrome and Firefox explicitly say "This site can't be reached" or "Your connection is not private" when a self-signed certificate is detected. Safari shows "This website may be impersonating." These messages are your browser's way of saying "I cannot verify this site is legitimate."
If you are unsure whether a site is legitimate, do not enter sensitive information. Instead, contact the organization through a phone number or address you find independently — not through a link on the suspicious site. Ask them directly whether they use that domain and whether they have a certificate issue.
Frequently Asked Questions
Does a self-signed certificate mean the site is definitely a scam?
Not necessarily. It could be a legitimate internal site, a test environment, or a small organization that made a poor security choice. But on a public site handling sensitive data, it is a red flag. If you are unsure, contact the organization through a phone number or address you find independently.
Can I make my browser stop warning me about self-signed certificates?
You can, but you should not do it for public websites. On internal networks, your IT department can distribute the certificate to your computer so the warning goes away. For personal projects, you can add an exception in your browser settings. Never add an exception for a public site you do not control.
Is my data safe if I enter a password on a site with a self-signed certificate?
The connection is encrypted, so someone on your network cannot read the password in transit. But you have no proof you are sending it to the real website. A hacker could be intercepting your connection and collecting passwords. Always verify the site is legitimate before entering sensitive information.
Why do some companies still use self-signed certificates?
Usually because they do not understand the difference, or because the site is internal and they forgot to update it when it became public. Occasionally a very small organization uses one to save money, but this is rare — trusted certificates are cheap or free. If a company you do business with uses a self-signed certificate, contact them and ask them to fix it.
Can a hacker create a self-signed certificate that looks legitimate?
They can create one that encrypts the connection, but your browser will show a warning because the certificate is not from a trusted authority. However, if you ignore the warning or if you are not paying attention, you might not notice. This is why self-signed certificates are a vulnerability on public sites — they train people to ignore browser warnings.