# Generating server SSL certificates and trust store

* The CA is self-signed:

When prompted for certificate information, everything is default.
```
$ openssl genrsa -out ca.key 2048
$ openssl req -x509 -new -key ca.key -nodes -out ca.pem -config ca-openssl.cnf -days 3650 -extensions v3_req
```

* Server certificate issued by CA:

```
$ openssl genrsa -out server.key.rsa 2048
$ openssl pkcs8 -topk8 -in server.key.rsa -out server.key -nocrypt
$ rm server.key.rsa
```

When prompted for certificate information, everything is default except the common name which is set to _localhost_ for simple testing.
```
$ openssl req -new -key server.key -out server.csr
$ openssl x509 -req -in server.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out server.pem -outform PEM -days 5000
```

*  Rename files

```
$ mv server.pem server-cert.pem
$ mv server.key server-key.pem
```

* Generate the PKCS12 trust store

When prompted for a password, the value is _s3cr3t_.
```
$ keytool -import -file server-cert.pem -alias server -keystore truststore.p12
```
