RTCPeerConnection.generateCertificate() static function

The static  RTCPeerConnection.generateCertificate() function creates an X.509 certificate and corresponding private key, returning a promise that resolves with the new RTCCertificate once it's generated.


let certPromise = RTCPeerConnection.generateCertificate(keygenAlgorithm)


A Web Crypto API AlgorithmIdentifier string or an Algorithm -subclassed object specifying an algorithm to use when creating the certificate's key.

RTCPeerConnection.generateCertificate() is a static method, so it is always called on the RTCPeerConnection interface itself, not an instance thereof.

Return value

A promise which resolves to a new RTCCertificate object containing a new key based on the specified options.


The normalized form of keygenAlgorithm specifies an algorithm or algorithm settings that the browser doesn't support, or which it does not allow for use with an RTCPeerConnection.

Other errors may occur; for example, if the specified keygenAlgorithm can't be successfully converted into an RTCCertificateExpiration dictionary, the error that occurs during that conversion will be thrown.


If a string is specified, it must be a Web Crypto API-compatible algorithm name string. Alternatively, you can provide specific details for the algorithm's configuration by providing an object based on one of the Web Crypto API's Algorithm class's subclasses.

Standard configurations

All browsers are required to support the following two configurations. It's entirely possible that a browser's default settings may be different, but these are always supported.


let stdRSACertificate = {
  name: "RSASSA-PKCS10-v1_5",
  modulusLength: 2048,
  publicExponent: new UInt8Array([1, 0, 1]),
  hash: "SHA-256"


let stdECDSACertificate = {
  name: "ECDSA",
  namedCurve: "P-256"

Certificate expiration time

By default the new certificate is configured with expires set to a DOMTimeStamp value of 2592000000, or 30 days. The expiration time cannot exceed 31536000000, or 365 days. It's also useful to note that browsers may further restrict the expiration time of certificates if they choose.


Specifying algorithm details

This example requests a new RSASSA-PKCS1-v1_5 certificate using a SHA-256 hash and a modulus length of 2048.

    name: 'RSASSA-PKCS1-v1_5',
    hash: 'SHA-256',
    modulusLength: 2048,
    publicExponent: new Uint8Array([1, 0, 1])
}).then(function(cert) {
  var pc = new RTCPeerConnection({certificates: [cert]});

Specifying an algorithm by name

The example below simply specifies a string requesting an ECDSA certificate.



Specification Status Comment
WebRTC 1.0: Real-time Communication Between Browsers
The definition of 'RTCPeerConnection.generateCertificate()' in that specification.
Candidate Recommendation Initial definition.

Browser compatibility

Update compatibility data on GitHub
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
generateCertificateChrome Full support 48Edge Full support ≤18Firefox Full support 22IE No support NoOpera Full support 43
Full support 43
Notes Promise-based version.
No support 37 — 43
Safari ? WebView Android Full support 48Chrome Android Full support 48Firefox Android Full support 44Opera Android Full support 43
Full support 43
Notes Promise-based version.
No support 37 — 43
Safari iOS ? Samsung Internet Android Full support 6.0


Full support  
Full support
No support  
No support
Compatibility unknown  
Compatibility unknown
See implementation notes.
See implementation notes.

See also