1. Set up your alternative CA.
]# mkdir -p /usr/local/ca/ca0
]# cd /usr/local/ca/ca0
]# mkdir certs crl new_certs private
]# touch index.txt && echo 01 > serial
2. Need to get a working ca.cnf and store it in /usr/local/ca/ca0/
<for a working ca.cnf see: http://pastebin.ca/51660>
<I believe if you use this you can skip step 3 below unless you want to edit [ req_distinguished_name ]
3. Edit ca.cnf
[ CA_default ] section change dir to /usr/lcoal/ca/ca0
Set certificate line to certificate = $dir/private/ca_cert.pem
Set private_key line to private_key = $dir/private/ca_keyfile.pem
[ req_distinguished_name ] section, I don't think needs changing, but I changed all the values...
That should be all you need to edit. Save the changes.
3. Create a Signing (CA) Authority.
]# cd private
]# openssl genrsa -des3 -out ca_keyfile 1024
<remember the password you give this>
]# openssl req -config /usr/local/ca/ca0/ca.cnf -new -x509 -days 3650 -key ca_keyfile.pem -out ca_cert.pem
4. Create a server cert. When asked for the common name use a FQDN. cd back out to /usr/local/ca/ca0
]# mkdir somedir
]# cd somedir
]# openssl req -newkey rsa:1024 -keyout foo_key.pem -keyform PEM -out foo_req.pem -outform PEM
<remember the password you give it. i can't remember if you need to fill in information, but if you do, remember common name, use FQDN>
]# export OPENSSL_CONF=/usr/local/ca/ca0/ca.cnf
]# openssl ca -in foo_req.pem -out foo.pem
<you will be asked for the ca_keyfile password. don't use the password for foo_key.pem>
]# unset OPENSSL_CONF
That should be it. in apache's conf, the server cert is foo.pem and the keyfile is foo_key.pem