Yunus Ekim

CertForge

Free SSL Certificate Generator

Enter your domains, prove you own them, and download the files your server needs. Wildcards included. No account, nothing to install.

Name the certificate

List every hostname the certificate should cover. A wildcard such as *.example.com covers one level of subdomains and is always validated over DNS.

One per line, or separated by commas. Up to 10.

Untrusted by browsers. Use it for a dry run.

Wildcards use DNS whatever you pick here.

Choose RSA only for older appliances and load balancers.

5 orders left for you in this window.

How it works

  1. 1

    List your domains

    Type every hostname the certificate should cover — the bare domain, www, any subdomain, or a wildcard such as *.example.com.

  2. 2

    Prove the domain is yours

    Add one DNS TXT record, or upload one small file to your site. The certificate authority checks that and nothing else.

  3. 3

    Download and install

    You get privkey.pem, cert.pem, chain.pem and fullchain.pem. Upload them to your server or paste them into your control panel.

Questions people ask

Is it really free?

Yes. The certificates come from Let's Encrypt and Buypass, two certificate authorities that issue at no charge. There is no trial, no card and no upsell — this page only automates the request.

How long does the certificate last, and how do I renew it?

Let's Encrypt certificates last 90 days, Buypass 180. Renewing means going through this page again before the old one expires. If you can install software on your server, an ACME client such as acme.sh or certbot renews on its own instead.

Can I create a wildcard certificate?

Yes. Enter *.example.com and it covers every first-level subdomain. Wildcards are always validated over DNS, so you will need to add a TXT record even if you picked the file method.

Is my private key safe?

The key is generated on this server, kept only in your session, and wiped when you click the button that ends the process. Nothing is logged and nothing is emailed. That said, any tool running on a server sees the key it makes — if you would rather no server ever touched it, run acme.sh or certbot on your own machine.

Do I need an account or any software?

Neither. No sign-up, no database, nothing to download. A browser and control over your domain's DNS or web root is all it takes.

Which files does my server need?

Most servers, nginx among them, want fullchain.pem and privkey.pem. Apache and most control panels ask for the three parts separately: cert.pem, privkey.pem and chain.pem.