An exemplary gist for creating self signed ssl certificate.

open-ssl-cheet-sheet.md

Combine a key & certificate in a PKCS#12 bundle:

openssl pkcs12 -export -out key.pkcs12 -inkey key.pem -in certificate.pem

Create a PKCS#12 certificate from a pem certificate:

openssl pkcs12 -export -out certificate.pkcs12 -nokeys -in certificate.pem

Validate PKCS#12 certificate:

openssl pkcs12 -in certificate.p12 -noout -info

Review self signed pem certificate:

openssl x509 -text -noout -in certificate.pem

openssl-self-signed-csr.conf

# How to use this:
# Save this gist in your computer to any-thing-you-like.conf
# Preform any changes you might want, then pass it to openssl like so:
# 
# openssl req -config self-signed-csr.conf -new -x509 -sha256 -newkey rsa:4096 -nodes -keyout key.pem -days 9999 -out certificate.pem
#
# Credit to this stackoverflow answer:
# https://stackoverflow.com/questions/10175812/how-to-create-a-self-signed-certificate-with-openssl#answer-27931596
# ==============================================================
[ req ]
default_bits        = 2048
default_keyfile     = keyfile.pem
distinguished_name  = subject
req_extensions      = req_ext
x509_extensions     = x509_ext
string_mask         = utf8only

# The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description).
#   Its sort of a mashup. For example, RFC 4514 does not provide emailAddress.
[ subject ]
countryName         = Country Name (2 letter code)
countryName_default = US

stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = California

localityName            = Locality Name (eg, city)
localityName_default    = New York

organizationName         = Organization Name (eg, company)
organizationName_default = The suicide squad

# Use a friendly name here because its presented to the user. The server's DNS
#   names are placed in Subject Alternate Names. Plus, DNS names here is deprecated
#   by both IETF and CA/Browser Forums. If you place a DNS name here, then you 
#   must include the DNS name in the SAN too (otherwise, Chrome and others that
#   strictly follow the CA/Browser Baseline Requirements will fail).
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default  = Clark Kent

emailAddress            = [email protected]
emailAddress_default    = [email protected]

# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
[ x509_ext ]

subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid,issuer

# You only need digitalSignature below. *If* you don't allow
# RSA Key transport (i.e., you use ephemeral cipher suites), then
# omit keyEncipherment because that's key transport.
basicConstraints    = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName      = @alternate_names
nsComment           = "OpenSSL Generated Certificate"

# RFC 5280, Section 4.2.1.12 makes EKU optional
# CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused
# In either case, you probably only need serverAuth.
extendedKeyUsage  = serverAuth, clientAuth

# Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
[ req_ext ]

subjectKeyIdentifier = hash

basicConstraints    = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName      = @alternate_names
nsComment           = "OpenSSL Generated Certificate"

# RFC 5280, Section 4.2.1.12 makes EKU optional
# CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused
# In either case, you probably only need serverAuth.
extendedKeyUsage  = serverAuth, clientAuth

[ alternate_names ]

IP.1 = 127.0.0.1
IP.2 = ::1

DNS.1 = my-cool-domain.com
DNS.2 = *.my-cool-domain.com
DNS.3 = localhost