sslcerts

(largely from here: http://www.tc.umn.edu/~brams006/selfsign.html,
step 1B, because we'll use a CA)

IMPORTANT:
- The common name for the server cert should be the name of the machine
- The common name for the ca cert should be different relative to the
  server cert.

a.) Generate the key and CA cert (once, assuming it hasn't expired)

openssl genrsa -des3 -out ca.key 4096
openssl req -new -x509 -days 9999 -key ca.key -out ca.crt

(follow prompts)

b.) Generate a server private key and signing request. Use a bad
password here, as we will strip it off later.

openssl genrsa -des3 -out key 4096
openssl req -new -key key -out csr

c.) Sign it with the cert. This set a 1 year expiry. Also, you need to
increment the serial number each time you issue a new cert

openssl x509 -req -days 365 -in csr -CA ../ca.crt -CAkey ../ca.key -set_serial 0001 -out crt

d.) clean the password out of server key:

openssl rsa -in key -out key.insecure
mv key.insecure key

e.) to view stuff

openssl rsa -noout -text -in key
openssl req -noout -text -in csr
openssl x509 -noout -text -in crt
openssl rsa -noout -text -in ca.key
openssl x509 -noout -text -in ca.crt

f.) convert to pem

openssl x509 -in ca.crt -out ca.pem