Generate an EC private key for the root certificate:
openssl-1.1 ecparam -name prime256v1 -genkey -noout -out root.key
Create a root certificate signing request:
openssl-1.1 req -new -key root.key -out root.csr -subj "/CN=Root CA"
Create a self-signed root certificate: