> Based on article https://www.baeldung.com/openssl-self-signed-cert

## Build a home made root CA

	mkdir -p /app/CA
	cd /app/CA

Create rootCA private key:

	openssl genrsa -des3 -out rootCA.key 4096

Create rootCA certificate:

	openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 7300 -out rootCA.pem


## Generate client root CA signed certificate for a client

Client private key:

	openssl genrsa -out raxus.swgalaxy.key 2048

Client certificate signature request:

	openssl req -new -key raxus.swgalaxy.key -out raxus.swgalaxy.csr

Root CA create a signed certificate using the certificate signature request:

	openssl x509 -req -CA rootCA.pem -CAkey rootCA.key -in raxus.swgalaxy.csr -out raxus.swgalaxy.crt -days 365 -CAcreateserial

Optionally create the full chain:

	cat raxus.swgalaxy.crt rootCA.pem > raxus.swgalaxy.fullchain.crt

Optionally create an export to be imported into a Oracle wallet:

	openssl pkcs12 -export \
		-in raxus.swgalaxy.crt \
		-inkey raxus.swgalaxy.key \
		-certfile rootCA.pem \
		-out raxus.swgalaxy.p12