From: ldo@nz.invalid   
      
   On Sat, 31 Aug 2024 00:54:42 -0000 (UTC), bp wrote:   
      
   > The command to generate the self-signed certificate and key pair was   
   > openssl req -new -x509 -days 365 -sha3-512 -keyout host.key -out host.crt   
   > based on instructions from   
   > https://docs.freebsd.org/en/books/handbook/security/ combined with some   
   > private correspondence suggesting it worked correctly.   
      
   I had a look at those instructions, and they don’t mention how to   
   generate the actual CA cert. Having your own CA cert means you only   
   have to import it once into a browser (or other SSL/TLS client), and   
   it will thereafter trust all certs signed by this CA.   
      
   The procedure for being your own CA is a lot simpler in OpenSSL 3. I   
   have some notes here .   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)