setup your own ca the easy way

install

apt install easy-rsa

setup

e.g. for an openvpn server

    cd /etc/openvpn/
    make-cadir ca2
    cd ca2/
    ./easyrsa init-pki
    ./easyrsa build-ca

generate server key and cert

    ./easyrsa gen-req openvpn-server nopass
    ./easyrsa sign-req server openvpn-client

generate client key and cert

newuser=openvpn-client

    ./easyrsa gen-req $newuser nopass
    ./easyrsa sign-req client $newuser

ls -lF /etc/openvpn/server/easy-rsa/pki/issued/$newuser.crt
ls -lF /etc/openvpn/server/easy-rsa/pki/private/$newuser.key

resources

FW https://community.openvpn.net/Pages/EasyRSA3-OpenVPN-Howto

https://www.marksei.com/vpn-openvpn-tutorial/