A self-signed certificate is one your own server generates and vouches for, rather than one issued by a trusted Certificate Authority (CA). Browsers have no reason to trust it, since anyone can generate one for any domain.
Why it’s a problem publicly
- Every visitor sees a full security warning, identical to an expired certificate
- It provides encryption but not identity verification — it doesn’t protect against impersonation the way a CA-issued certificate does
When it’s actually fine
Internal-only services (staging environments, internal admin tools not exposed publicly) are a reasonable use case, since the small set of users can be told to trust it explicitly or install it in their local trust store.
FAQ
Is there ever a good reason to use one on a public site?
No — free, automated CA-issued certificates (Let’s Encrypt) remove the cost/effort argument entirely, so there’s no real justification for a self-signed certificate on a public-facing site.