网上有这方面的教程，但我碰巧有一个以前做过的记录。它比您需要的要多得多，但会向您展示如何实现创建自己的 CA 和从中签名的证书的基础知识。我的记录，贴在下面，创建一个CA，创建一个由CA签名的中间CA，最后创建一个可以在服务器上使用的证书。您显然不需要中间 CA，因此您应该跳过中间位并使用根 CA 而不是中间 CA 签署最终/结束证书，例如，在创建 end.crt 时，而不是使用 ../inter_ca/inter.key 签名，而是使用 ../root_ca/rootca.key 等。
我假设您在这里提出了正确的正确问题，并且自签名证书确实是您想要的。
在创建证书和密钥之后，还有关于配置 Apache 的指导，以及如何使用 OpenSSL 工具来验证它是否正常工作的说明（在任何 SSL TCP 连接上，因此适用于 Cowboy 或其他任何东西）。这将向您显示信任链，尽管您的信任链将是深度 1 而不是深度 2，因为您将省略中间 CA。
创建一些目录来使用：
mkdir inter_ca_demo
cd inter_ca_demo
mkdir root_ca inter_ca end_cert
cd root_ca
创建密钥：
openssl genrsa -out rootca.key 2048
输出将类似于：
Generating RSA private key, 2048 bit long modulus
...........................................................+++
.............................+++
e is 65537 (0x10001)
自签名以创建您的根 CA 证书（您必须输入将编码到证书中的各种信息）：
openssl req -x509 -new -nodes -key rootca.key -days 1024 -out rootca.pem
它应该看起来像（在这里你可以看到我输入的内容）：
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:GB
State or Province Name (full name) [Some-State]:London
Locality Name (eg, city) []:London
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Method Analysis Ltd
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:methodanalysis.com
Email Address []:ca_admin@methodanalysis.com
在继续使用中间证书之前，您必须重命名、复制或创建指向根证书的链接，以便可以通过哈希算法找到它。这是为了确保在您的 CA 路径中有很多受信任的证书时性能不会降低。为此，您必须使用以下命令找出哈希是什么：
openssl x509 -noout -hash -in rootca.pem
输出应该是这样的：
03ed4e37
然后创建链接，将 .0 添加到 YOUR HASH（作为上一个命令的输出）：
ln -s rootca.pem 03ed4e37.0
现在创建中间 CA 密钥和 CSR（证书签名请求）（您必须输入将被编码到证书中的各种信息）：
cd ../inter_ca
openssl genrsa -out inter.key 2048
openssl req -new -key inter.key -out inter.csr
它应该看起来像这样：
$ openssl genrsa -out inter.key 2048
Generating RSA private key, 2048 bit long modulus
.........................................+++
..............................................................+++
e is 65537 (0x10001)
$ openssl req -new -key inter.key -out inter.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:GB
State or Province Name (full name) [Some-State]:London
Locality Name (eg, city) []:London
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Intermediate certificates R US Ltd
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:intermediatecasrus.com
Email Address []:ca_admin@intermediatecasrus.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
现在创建一个文件 (v3x509extensions.txt)，其中包含表明这应该是中间 CA 的数据，然后生成中间证书，使用您的根 CA 签名：
echo 'basicConstraints=CA:TRUE' > v3x509extensions.txt
openssl x509 -req -extfile v3x509extensions.txt -in inter.csr -CA ../root_ca/rootca.pem -CAkey ../root_ca/rootca.key -CAcreateserial -out inter.crt -days 200
它应该看起来像这样：
Signature ok
subject=/C=GB/ST=London/L=London/O=Intermediate certificates R US Ltd/CN=intermediatecasrus.com/emailAddress=ca_admin@intermediatecasrus.com
Getting CA Private Key
现在创建您的最终密钥（您将用于 SSL 网站（例如）），从中创建一个 CSR，并使用您的中间证书对其进行签名，生成一个新证书：
cd ../end_cert
openssl genrsa -out end.key 2048
openssl req -new -key end.key -out end.csr
openssl x509 -req -in end.csr -CA ../inter_ca/inter.crt -CAkey ../inter_ca/inter.key -CAcreateserial -out end.crt -days 500
它应该看起来像这样：
$ openssl genrsa -out end.key 2048
Generating RSA private key, 2048 bit long modulus
................................................+++
.....................................................+++
e is 65537 (0x10001)
$ openssl req -new -key end.key -out end.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:GB
State or Province Name (full name) [Some-State]:London
Locality Name (eg, city) []:London
Organization Name (eg, company) [Internet Widgits Pty Ltd]:End User Ltd
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:intermediatecademo-enduser.com
Email Address []:support@intermediatecademo-enduser.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
$ openssl x509 -req -in end.csr -CA ../inter_ca/inter.crt -CAkey ../inter_ca/inter.key -CAcreateserial -out end.crt -days 500
Signature ok
subject=/C=GB/ST=London/L=London/O=End User Ltd/CN=intermediatecademo-enduser.com/emailAddress=support@intermediatecademo-enduser.com
Getting CA Private Key
此时，您可以通过验证信任链来检查一切是否正常，这里我将中间证书和“结束”证书连接起来，然后仅使用根 CA 路径验证它们（记住“结束”证书可以） t 在没有中间 CA 的情况下进行验证，因此必须使用“结束”证书）：
cat ../inter_ca/inter.crt end.crt | openssl verify -CApath ../root_ca
输出应该是：
stdin: OK
例如，如果您在 apache 中使用这些密钥，您可以像这样配置它们：
SSLCertificateFile FULL_PATH_TO/inter_ca_demo/end_cert/end.crt
SSLCertificateKeyFile FULL_PATH_TO/inter_ca_demo/end_cert/end.key
SSLCertificateChainFile FULL_PATH_TO/inter_ca_demo/inter_ca/inter.crt
SSLCACertificatePath FULL_PATH_TO/inter_ca_demo/root_ca
Apache 现在将提供中间证书及其自己的证书，这允许 Web 客户端使用“openssl verify”执行与上述相同类型的验证（以及其他检查）。
如果您确实将这些证书与 apache 一起使用，并且您创建了一个名称为“intermediatecademo-enduser.com”的网站以与您创建的“end”证书保持一致，您还可以使用 openssl 来验证来自客户端的证书观点：
openssl s_client -connect intermediatecademo-enduser.com:443 -CApath root_ca -verify 5
输出应该是这样的：
verify depth is 5
CONNECTED(00000004)
depth=2 C = GB, ST = London, L = London, O = Method Analysis Ltd, CN = methodanalysis.com, emailAddress = ca_admin@methodanalysis.com
verify return:1
depth=1 C = GB, ST = London, L = London, O = Intermediate certificates R US Ltd, CN = intermediatecasrus.com, emailAddress = ca_admin@intermediatecasrus.com
verify return:1
depth=0 C = GB, ST = London, L = London, O = End User Ltd, CN = intermediatecademo-enduser.com, emailAddress = support@intermediatecademo-enduser.com
verify return:1
---
Certificate chain
0 s:/C=GB/ST=London/L=London/O=End User Ltd/CN=intermediatecademo-enduser.com/emailAddress=support@intermediatecademo-enduser.com
i:/C=GB/ST=London/L=London/O=Intermediate certificates R US Ltd/CN=intermediatecasrus.com/emailAddress=ca_admin@intermediatecasrus.com
1 s:/C=GB/ST=London/L=London/O=Intermediate certificates R US Ltd/CN=intermediatecasrus.com/emailAddress=ca_admin@intermediatecasrus.com
i:/C=GB/ST=London/L=London/O=Method Analysis Ltd/CN=methodanalysis.com/emailAddress=ca_admin@methodanalysis.com
---
Server certificate
...
...
...
Start Time: 1445696823
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
它现在会挂起，等待发送数据。你可以CTRL+C退出。