- 4 minutes to read

Development Certificates for Nodinite Testing

For development and test environments that need HTTPS without a production Certificate Authority (CA), PowerShell's New-SelfSignedCertificate can generate self-signed certificates and configure browser trust automatically.

Warning

Self-signed certificates are for development and testing only. Do not use in production. Browsers show security warnings unless the certificate is manually trusted on each client machine.

Generate Self-Signed Certificate (PowerShell)

Simple Example (Minimal Configuration) 

# Localhost certificate (minimal configuration)
New-SelfSignedCertificate `
    -DnsName "localhost" `
    -CertStoreLocation "cert:\LocalMachine\My" `
    -NotAfter (Get-Date).AddYears(2)

# Configure your DNS name(s)
$dnsNames = @("nodinite.dev.local", "nodinite")

# Create certificate with security best practices
$cert = New-SelfSignedCertificate `
    -DnsName $dnsNames `
    -Subject "CN=$($dnsNames[0])" `
    -FriendlyName "Nodinite Dev SSL ($($dnsNames[0]))" `
    -KeyAlgorithm RSA -KeyLength 2048 `
    -HashAlgorithm SHA256 `
    -KeyExportPolicy Exportable `
    -NotAfter (Get-Date).AddYears(2) `
    -CertStoreLocation "Cert:\LocalMachine\My"

# Display certificate details
$cert|Format-List Subject, DnsNameList, Thumbprint, NotAfter

# Export certificate for backup and trust
New-Item -ItemType Directory -Force -Path C:\certs|Out-Null
$pfxPassword = Read-Host -AsSecureString -Prompt "Enter PFX password (for backup)"
Export-PfxCertificate -Cert $cert -FilePath "C:\certs\$($dnsNames[0]).pfx" -Password $pfxPassword|Out-Null
Export-Certificate -Cert $cert -FilePath "C:\certs\$($dnsNames[0]).cer"|Out-Null
Import-Certificate -FilePath "C:\certs\$($dnsNames[0]).cer" -CertStoreLocation Cert:\LocalMachine\Root|Out-Null

Write-Host "Certificate created successfully!" -ForegroundColor Green
Write-Host "Thumbprint: $($cert.Thumbprint)" -ForegroundColor Cyan
Write-Host "Files created in C:\certs\" -ForegroundColor Yellow

What This Script Does

  1. Creates certificate with SHA-256 (secure), 2048-bit RSA key
  2. Sets Subject Alternative Names (SANs) — Certificate valid for all specified DNS names
  3. Exports to .pfx format — Includes private key, password-protected (for backup/migration)
  4. Exports to .cer format — Public certificate only (for distribution to clients)
  5. Automatically trusts certificate — Imports .cer to Trusted Root Certification Authorities
  6. Displays subject and thumbprint — Use the subject (or a SAN) as the Certificate subject in the Nodinite Portal; you need the thumbprint only to pin this exact certificate

Certificate Storage Locations

  1. Personal Store (cert:\LocalMachine\My) — Used by IIS for HTTPS binding (requires private key)
  2. Trusted Root Certification Authorities (cert:\LocalMachine\Root) — Same certificate copied here so browsers trust it

Important

The recommended PowerShell script above automatically handles both locations. If you used the minimal example, follow the manual trust steps below.

Tip

Nodinite v7: After generating the certificate, the Nodinite installer finds it by the Certificate subject you set in the Portal (Step 4: Servers → Core host Configuration). Make sure the subject or a SAN matches the host name, then run the update package again (Update Nodinite v7) so IIS binds the new certificate. You only need to change the Portal if you pinned a Certificate thumbprint; in that case, enter the new thumbprint or clear the field.

Trust Self-Signed Certificate (Manual Method)

If you used the minimal certificate example (not the recommended script), manually copy the certificate to Trusted Root:

Option 1: Using PowerShell 

# Get the certificate thumbprint (from script output or find it)
$certificateThumbprint = "YOUR_CERTIFICATE_THUMBPRINT_HERE"

# Get certificate from Personal store
$certificate = Get-ChildItem -Path "Cert:\LocalMachine\My\$certificateThumbprint"

# Export to file
Export-Certificate -Cert $certificate -FilePath "C:\Temp\nodinite-dev.cer"

# Import to Trusted Root Certification Authorities
Import-Certificate -FilePath "C:\Temp\nodinite-dev.cer" `
    -CertStoreLocation "Cert:\LocalMachine\Root"

Option 2: Using Certificate Manager (GUI)

  1. Press Win+R, type certlm.msc, press Enter
  2. Navigate to Personal → Certificates
  3. Find your certificate (e.g., CN=nodinite.dev.local)
  4. Right-click → Copy
  5. Navigate to Trusted Root Certification Authorities → Certificates
  6. Right-click in the right pane → Paste

Tip

Why copy to Trusted Root? Self-signed certificates act as their own Certificate Authority. Browsers check the Trusted Root store to determine if they should trust a certificate. Without this step, browsers show "Your connection is not private" warnings.

Certificate Backup

The .pfx file contains your private key (password-protected). Store it securely — you will need it if you:

  • Rebuild your server
  • Move the certificate to another machine
  • Recover from a disaster

Next Steps