The commands are taken from here
- Create the root certificate (rootCA.pem) and the key (rootCA.key):
> openssl genrsa -des3 -out rootCA.key 2048
> openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 16384 -out rootCA.pem
- Trust the
rootCA.pem
on the device which later will act as the client. Keep therootCA.key
private. - Create a file called
server.csr.cnf
(or, for automation purposes, find a way in which you can pass these values to the later command directly) with the following content: