SSL Certificate signed by your own CA

1. Generate self-signed root CA certificate

 mkdir -p /root/internalca
 cd /root/internalca

 openssl genrsa -out rootCAKey.pem 2048
 openssl req -x509 -sha256 -new -nodes -key rootCAKey.pem -days 3650 -out rootCACert.pem
to check it
 openssl x509 -in rootCACert.pem -text

2. Generate certificate request

 mkdir -p /tmp/rbakeys
 cd /tmp/rbakeys

 openssl genrsa -out rbaServerKey.pem 2048
 openssl req -new -key rbaServerKey.pem -sha256 -out rbaServerCert.csr
to check CSR
 openssl req -in rbaServerCert.csr -noout -text

3. Generate and sign certificate

 openssl x509 -req -sha256 -in rbaServerCert.csr -CA /root/internalca/rootCACert.pem -CAkey /root/internalca/rootCAKey.pem -CAcreateserial -out rbaServerCert.pem -days 365
to check certificate 
 openssl x509 -in rbaServerCert.pem -text -noout