#Generate private key for CA
openssl genrsa -des3 -out aem.key 2048

#Generate certificate for CA
openssl req -x509 -new -nodes -key aem.key -sha256 -days 3650 -out aem.pem

#Generate private key for Server
openssl genrsa -out author-aem.key 2048

#Generate certificate request
openssl req -new -key author-aem.key -out author-aem.csr

#Create certificate extension file
echo "authorityKeyIdentifier=keyid,issuer" > author-aem.ext
echo "basicConstraints=CA:FALSE" >> author-aem.ext
echo "keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment" >> author-aem.ext
echo "subjectAltName = @alt_names" >> author-aem.ext
echo "" >> author-aem.ext
echo "[alt_names]" >> author-aem.ext
echo "DNS.1 = author.local" >> author-aem.ext
echo "DNS.2 = www.author.local" >> author-aem.ext

#Create certificate signed with CA for Server
openssl x509 -req -in author-aem.csr -CA aem.pem -CAkey aem.key -CAcreateserial -out author-aem.crt -days 3650 -sha256 -extfile author-aem.ext

#Convert private key to der format to use it in AEM
openssl pkcs8 -topk8 -inform PEM -outform DER -in author-aem.key -out author-aem.key.der -nocrypt