1. Generate private key for local test CA.

openssl genrsa -out localTestCA.key 2048

2. Generate certificate of the local test CA.

openssl req -x509 -new -nodes -key localTestCA.key -sha256 -days 1095 -out localTestCA.crt

3. Check the certificate of the CA.

openssl x509 -in localTestCA.crt -text -noout

4. Request and retrieve a certificate from the local test CA.

# Set your test domain
export DOMAIN=localhost

# Generate private key for development
openssl genrsa -out $DOMAIN.key 2048

# Generate CSR(Certificate Signing Request)
openssl req -new -key $DOMAIN.key -out $DOMAIN.csr

# Generate X.509 extension which include SAN field
cat > $DOMAIN.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = $DOMAIN
EOF

# Sign the CSR using the local test CA
openssl x509 -req -in $DOMAIN.csr -CA ./localTestCA.crt -CAkey ./localTestCA.key -CAcreateserial -out $DOMAIN.crt -days 365 -sha256 -extfile $DOMAIN.ext

5. Check the certificate for your development server.

openssl x509 -in $DOMAIN.crt -text -noout

6. Register the ceritificate of local test CA, NOT server certificate.