I built an app, which authenticates users via oauth2. I have a simple server that can accept requests.

After authentication, the user is redirected to<token> and the app listens on this port.

How can I make a certificate to accept a callback from the host? Self-signed certificates are restricted on many browsers.

Let's Encrypt and many other certificates are for domains, not local hosts.

  • Self-signed certificates are not restricted on many browsers. They just show a warning.
    – schroeder
    Mar 19, 2021 at 13:01
  • If you do not want a self-signed certificate then you need a certificate authority in the local network. This is a lot of work. A self-signed certificate really is the way to go.
    – schroeder
    Mar 19, 2021 at 13:03
  • It can self signed, its not important, but as i say "The page you are trying to view cannot be shown because the authenticity of the received data could not be verified", maybe thats not is certificate problem. Mar 19, 2021 at 13:55
  • This is a warning about the certificate, yes. But you can still go to the page and it will be encrypted.
    – schroeder
    Mar 19, 2021 at 14:50
  • Weirdly near identical to stackoverflow.com/questions/66705354/… just hours earlier which I referred to stackoverflow.com/questions/6793174/… Mar 20, 2021 at 0:43

1 Answer 1


Why do you want to run https to localhost anyway? There's no point in it.

TLS is meant to guarantee confidentiality, integrity, and authenticity of the connection against an attacker living on the network path between you and the server, but if you're connecting to localhost, there IS nothing between you and the server.

CA's won't issue a certificate to localhost, a certificate embedded in your desktop app can be easily reverse engineered and stolen, and a self-signed certificate is as good for security as none at all.

Just use plain http to localhost.

If you're worried that browsers will spook at you for "mixed content" or something, don't worry—modern browsers (at least I'm pretty sure Firefox does) treat localhost as secure regardless of how you connect to it.

  • When oauth is finished, its redirect to https://localhost with token. Host restrict to create callback with http scheme, only https. I dont care about notify, that sertificate self signed etc., but browser say me "The page you are trying to view cannot be shown because the authenticity of the received data could not be verified." Mar 19, 2021 at 13:48
  • @AliceThornberry you don't have any control over the redirect uri scheme? Mar 21, 2021 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .