title: Apache warns that my self-signed certificate is a CA certificate
body: <p>As I don't know the openssl command's arguments by heart, I am used to referring to the same <a href="https://stackoverflow.com/a/10176685/2516943">SO answer</a> whenever I need to create self-signed certificates (for testing environments). The command looks like:</p>
  
  <pre><code>openssl req -x509 -nodes -newkey rsa:2048 -keyout mysite.key -out mysite.crt -days 365
  </code></pre>
  
  <p>And it usually works, for instance on my current Ubuntu 15.10. Today I'm on a fresh install of Debian Jessie and it doesn't. Apache warns at startup that:</p>
  
  <pre><code>[ssl:warn] [pid 1040] AH01906: www.mysite.com:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
  </code></pre>
  
  <p>I looked for a solution to the problem and found <a href="https://www.turnkeylinux.org/forum/support/20121228/rsa-server-certificate-ca-certificate-error#comment-17556" rel="noreferrer">an answer in a linux forum</a> stating that the following should be used instead:</p>
  
  <pre><code>openssl genrsa -des3 -passout pass:x -out mysite.pass.key 2048
  openssl rsa -passin pass:x -in mysite.pass.key -out mysite.key
  openssl req -new -key mysite.key -out mysite.csr
  openssl x509 -req -days 365 -in mysite.csr -signkey mysite.key -out mysite.crt
  </code></pre>
  
  <p>And it's true, this way the Apache warning disappears.</p>
  
  <p>As far as I understand, this creates a passphrase-protected key, then removes the passphrase, then creates a CSR, then generates the certificate with both the CSR and the key.</p>
  
  <p>So the question is: what does this longer version do that the shorter doesn't, and why is it necessary in some cases (like today for me)?</p>