$ mkdir certdir
$ botan keygen > ca_key.pem
$ botan gen_self_signed --ca ca_key.pem my_root_authority > certstore/ca_cert.pem

$ botan keygen > server_key.pem
$ botan gen_pkcs10 server_key.pem localhost > server_csr.pem
$ botan sign_cert certdir/ca_cert.pem ca_key.pem server_csr.pem > server_cert.pem

# botan tls_server server_cert.pem server_key.pem

$ botan tls_client localhost --trusted-cas=certdir
Certificate validation status: Verified
Handshake complete, TLS v1.2 using CECPQ1_RSA_WITH_CHACHA20_POLY1305_SHA256
Session ID ...