openssl genrsa -des3 -out rootCA.key 4096
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3285 -out rootCA.pem
openssl x509 -outform der -in rootCA.pem -out /usr/local/share/ca-certificates/rootCA.crt
update-ca-certificates

openssl genrsa -out server.key 4096
openssl req -new -key server.key -out server.csr

openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 3285 -sha256