The simplest way to create a self-signed certificate is to use OpenSSL with the following one-liner:
$ openssl req -new -x509 -sha256 -newkey rsa:2048 -nodes \ -keyout key.pem -out cert.pem -days 3650 \ -subj "/C=US/ST=NY/L=New York/O=Foo Corp/OU=Bar Div/CN=www.foo.com" \ -config self-signed.conf
It is often useful to create a single .pem file containing both the key and the cert:
$ cat key.pem cert.pem >self-signed.pem
These steps also work on Windows, except that you will need to use openssl.exe and type to concatenate the files:
C:\path\to\wherever> type key.pem cert.pem >self-signed.pem
This resulting .pem file can be used by a webserver to provide HTTPS, but will generally result in web browsers being reluctant to display the resulting webpages, precisely because the certificate is self-signed.
It is easy enough to click through the sequence of warning dialogue boxes that browsers present the user with and get the browser to accept the certificate. Sometimes however, users would prefer to explicitly trust the certificate and avoid the ominous red warning signs that browsers typically decorate the address bar with when rendering pages encrypted with the certificate (see next question). Some browsers, notably Chrome, are more demanding of the certificate and require further structure; most versions of OpenSSL need directives provided via a configuration file to create this structure. For example, a configration file self-signed.conf with the following content:
[req] x509_extensions = x509_ext distinguished_name = dn [dn] CN = www.foo.com [x509_ext] keyUsage = keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1 = www.foo.com DNS.2 = *.foo.com IP.1 = 127.0.0.1
can be provided to OpenSSL via the -config option:
$ openssl req -new -x509 -sha256 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 3650 -subj "/C=US/ST=NY/L=New York/O=Foo Corp/OU=Bar Div/CN=www.foo.com" -config self-signed.conf
Note: this content is a digest of several answers provided in this StackOverflow thread.