Comment by jordemort

I really like step[1] and step-ca[2] for this, it's a lot less fiddly than having to drive OpenSSL directly.

1. https://github.com/smallstep/cli

2. https://github.com/smallstep/certificates