I've found this article and this what I used to generate CA cert:

openssl genrsa -des3 -out myCA.key 2048
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1825 -out myCA.pem

I name it "MyCert"

And I used it to sign the cert I generated for localhost (it was the output of ChatGPT)

$ openssl req -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.csr
$ openssl x509 -req -in localhost.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out localhost.crt -days 365 -sha256

I've added the CA cert to the system (I use Fedora):

sudo cp myCA.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust extract

I restarted the server and when access https://localhost

Got this error:

Subject: localhost
Issuer: MyCert

What did I wrong? I use default fields for the CA cert:

CN = MyCert
O = Default Company Ltd
L = Default City
C = pl

and the localhost cert have those fields:

CN = localhost
C = pl

How to properly create CA cert and sign the cert for Apache on Fedora?

  • 1
    Did you add localhost to the SAN?
    – Greg Askew
    Mar 26 at 21:06
  • Install xca, I've not seen any other frontend to ssl certs that comes close.
    – Bib
    Mar 26 at 22:04
  • See this answer (not a dup because you want a CA + cert and not a self-signed cert, but the details on the cert are very similar, especially the need for the SAN).
    – jcaron
    Mar 27 at 9:24

1 Answer 1


This worked for me:

  1. Generate CA certificate.
openssl req -x509 -new -nodes -newkey rsa:2048 -keyout myCA.key \
  -sha256 -days 1825 -out myCA.crt -subj /CN='localhost ca'
  1. Generate the server certificate request. Note that in addition to setting CN=localhost we're also setting a subjectAlternativeName for localhost, because:

RFC 2818, published in May 2000, deprecates the use of the Common Name (CN) field in HTTPS certificates for subject name verification. Instead, it recommends using the “Subject Alternative Name” extension (SAN) of the “dns name” type. ref

(Note that the deprecation of commonName for identifying hosts was 24 years ago.)

openssl req -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.csr \
  -subj /CN=localhost -addext subjectAltName=DNS:localhost
  1. Sign the certificate request to create a certificate. Note the use of -copy_extensions copy so that we copy the subjectAlternativeName from the request to the certificate.
openssl x509 -req -in localhost.csr -copy_extensions copy \
  -CA myCA.crt -CAkey myCA.key -CAcreateserial -out localhost.crt -days 365 -sha256
  1. Add the CA certificate to the trust store.
sudo cp myCA.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

I'm testing the certificate by setting up a simple TLS-enabled server using caddy. I start with this Caddyfile:

    http_port 8080
:8443 {
    respond "this is a test"
    tls localhost.crt localhost.key

And then:

caddy run

And now we can see that curl trusts the certificate:

$ curl https://localhost:8443
this is a test

If I remove the CA certificate from the trust store:

sudo rm  /etc/pki/ca-trust/source/anchors/myCA.crt
sudo update-ca-trust

Then we will see that curl fails:

$ curl https://localhost:8443
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .