Question: I am creating come server-client application and I want to get the certificate. I tried to find some tutorials, for example I found this: 

```
openssl req -x509 -out localhost.crt -keyout localhost.key \
 -newkey rsa:2048 -nodes -sha256 \
 -subj '/CN=localhost' -extensions EXT -config <( \
 printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")

```

But I got "Cannot find file". Please, tell me how to do it.

Answer: 
Might be easiest to use EasyRSA, that way you setup a CA and you can then sign as many certificates as you need and get a key you can insert into your clients so they stop whining about the self-signed certificate.

It's distributed with OpenVPN, but can easily be used without OpenVPN.

Just remember that modern browsers want a SAN (Subject Alternate Name), they get unhappy if there's only a CN (Common Name).

<https://github.com/OpenVPN/easy-rsa>

How:

* set your variables in the vars file
* Initialise the pki: 

`./easyrsa init-pki`
* Build the rootCA: 

`./easyrsa build-ca`
* Generate a key and certificate in one go for example.com also for a wildcard 

`./easyrsa --subject-alt-name=DNS:example.com,DNS:\*.example.com build-server-full example.com nopass`

Keys and certificates will be in a tree in the pki subdirectory.
Generate certificate using the below codes. Create these files in a folder. Using command prompt navigate ("cd") to that folder and then run "bash generate.sh" without quotes. Please note you need to have bash installed. If you have installed git-scm then you should have bash already. Then a folder named certificates should be generated. If you want to git clone the GitHub project, the link is <https://github.com/micsel/generate-trusted-ssl-certificate>

generate.sh

```
#!bin/bash

if [ ! -d $PWD/certificates ]; then
  mkdir -p $PWD/certificates;
fi
openssl req \
  -newkey rsa:2048 \
  -x509 \
  -nodes \
  -keyout certificates/server.key \
  -new \
  -out certificates/server.crt \
  -config ./openssl-custom.cnf \
  -sha256 \
  -days 365

openssl req \
  -newkey rsa:2048 \
  -x509 \
  -nodes \
  -keyout certificates/key.pem \
  -new \
  -out certificates/cert.pem \
  -config ./openssl-custom.cnf \
  -sha256 \
  -days 365

```

openssl-custom.cnf

```
[req]
default_bits = 2048
prompt = no
default_md = sha256
x509_extensions = v3_req
distinguished_name = dn

[dn]
C = UK
L = Olathe
O = Dev
OU = Dev Department
emailAddress = youremail@yourdomain.com
CN = localhost

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = *.localhost
DNS.2 = localhost

```