This question already has an answer here:

I am trying to set up a development environment that mirrors my live server, but behind the firewall.

Until fairly recently my shared hosting site didn't offer TLS/SSL so it wasn't an issue/option, but now that encryption is the norm I need to reconfigure my development environment.

In the past, I had a Ubuntu server running in a container on my workstation (configured with Webmin) with the same domain name (ex: example.com) and directory structure as the live server. I put an entry for example.com in my /etc/hosts file so that my web browser would hit the local server instead of the live server. This allowed me to perfectly stage my WordPress site and then deploy to the live server with simple copy operations and not have to use "migration plugins" which not only cost money, but may also introduce errors.

My problem is that now I need to correctly mimic the operation of TLS (locally) to be able to run/test my WordPress sites.

The "live" site example.com uses a "Let's Encrypt" wildcard certificate, (so I can't use Let's Encrypt in any way without messgin the live site up) but for the development it would be quite acceptable to have a self-signed certificate of some kind as long as it's good enough that I can "add exception" to the browser. I don't need to allow anyone outside the firewall to visit the development/staging site - the site only needs to be able to "call out" to pick up updates to plugins and themes.

All the examples I have seen either describe setting up Let's Encrypt or setup as localhost, but nothing on "spoofing" a server.

Is this possible?

marked as duplicate by garethTheRed, Rui F Ribeiro, jimmij, Kusalananda, Michael Homer Mar 8 at 21:08

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


The simplest way is to create selfsigned certificate, add it to the web server. And do not forget to add it to the browser (to avoid) warning messages.

You can check here how to do this

You can do that in one command:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

You can also add -nodes (short for no DES) if you don't want to protect your private key with a passphrase. Otherwise it will prompt you for "at least a 4 character" password.

The days parameter (365) you can replace with any number to affect the expiration date. It will then prompt you for things like "Country Name", but you can just hit Enter and accept the defaults.

Add -subj '/CN=localhost' to suppress questions about the contents of the certificate (replace localhost with your desired domain).

Self-signed certificates are not validated with any third party unless you import them to the browsers previously. If you need more security, you should use a certificate signed by a certificate authority (CA).

  • 1
    I had to add -nodes (short for no DES) to get it to work. I suspect the prompt for a password was causing problems. As expected, I get an error message, but that's OK as I can bypass it which is fine for development. It took a fair bit of time to figure out as there were no meaningful error messages. – user73383 Mar 19 at 23:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.