Editing SSL Certificate signed by your own CA

1. Generate self-signed root CA certificate
  mkdir -p /root/internalca
  cd /root/internalca
 
  openssl genrsa -out rootCAKey.pem 2048
  openssl req -x509 -sha256 -new -nodes -key rootCAKey.pem -days 3650 -out rootCACert.pem
 ''to check it''
  openssl x509 -in rootCACert.pem -text
 
2. Generate certificate request
  mkdir -p /tmp/rbakeys
  cd /tmp/rbakeys
 
  openssl genrsa -out rbaServerKey.pem 2048
  openssl req -new -key rbaServerKey.pem -sha256 -out rbaServerCert.csr
 ''to check CSR''
  openssl req -in rbaServerCert.csr -noout -text

You can use config file
 vi ServerCertReq.config
 
 [req]
 req_extensions = v3_req
 distinguished_name = dn
 prompt = no
 
 [dn]
 CN = <FQDN of your RBA server>
 C = <Country Name (2 letter code)>
 L = <Locality Name (eg, city)>
 O = <Organization Name (eg, company)>
 OU = <Organizational Unit Name (eg, section)>
 
 [v3_req]
 subjectAltName = DNS:<FQDN of your RBA server> 
 
 ''and to create CSR''
 openssl req -new -key rbaServerKey.pem -sha256 -out rbaServerCert.csr -config ServerCertReq.config

3. Generate and sign certificate 
  openssl x509 -req -sha256 -in rbaServerCert.csr -CA /root/internalca/rootCACert.pem -CAkey /root/internalca/rootCAKey.pem -CAcreateserial -out rbaServerCert.pem -days 365
 ''to check certificate'' 
  openssl x509 -in rbaServerCert.pem -text -noout