Certificates (PKI) config generator
Creates a certificate authority and issues server and client certificates from it — real X.509 PEM files, signed in your browser with the Web Crypto API. This is the PKI that OpenVPN, IPsec and SSL VPN configs need.
Usually the VPN hostname
Comma separated hostnames and IPs
Up to 10; each gets its own key pair
Nothing generated yet
Fill in the details above and press Generate. Every key is created with your browser's Web Crypto API and never leaves this tab.
ca.key is the crown jewel
Anyone holding the CA private key can mint certificates your VPN will trust. Store it offline, never copy it onto the VPN server, and give each device only its own .crt and .key pair.
Use these in a VPN config
Paste the PEM contents into the OpenVPN generator to build a single-file .ovpn profile, or reference the files directly from an ocserv or strongSwan config.
Generated locally, stored nowhere
Keys and passwords come from your browser's crypto RNG. Nothing you type or generate is sent to a server, written to storage, or recoverable by anyone once you close this tab.