I'm looking at building a root-CA for use with something I'm putting together.
Each customer would register their own server with me and I'd sign their cert as the holder of (id).example.com. Each customer would securely download my CA cert and set it as trusted for the example.com and sub-domains only.
How do I set my own CA-cert as applicable for example.com only? My customers are not going to want to trust me to sign (say) paypal.com, just the domain and it's subdomains I made it for. I also don't want to be in a position where someone could force me to sign their dodgy cert.
(I'm looking at openssl at the moment, but any alternatives are fine. If it's just a command line option, it's currently elluding me.)