setup your own ca the easy way

install

apt install easy-rsa

setup

e.g. for an openvpn server

    cd /etc/openvpn/
    make-cadir ca2
    cd ca2/
    ./easyrsa init-pki
    ./easyrsa build-ca
    ./easyrsa gen-req openvpn-client nopass
    ./easyrsa gen-req openvpn-server nopass
    ./easyrsa sign-req server openvpn-client
    ./easyrsa sign-req client openvpn-client

resources

FW https://community.openvpn.net/Pages/EasyRSA3-OpenVPN-Howto

https://www.marksei.com/vpn-openvpn-tutorial/