Setup a directory to be used as the root of the certificate authority, e.g /home/user/documents/identity/ca.
First, create the root key/certificate pair root.{key,crt} that will be used to sign client requests. For example:
openssl genrsa -out root.key 4096