Let’s create your own Certificate Authority and SSL certificates.

Source: How to Create Your Own SSL Certificate Authority for Local HTTPS Development

Becoming a (tiny) Certificate Authority

First we generate the private key:

$ openssl genrsa -des3 -out myCA.key 2048

You will be prompted for a passphrase. Keep it safe. The pass phrase will prevent anyone who gets your private key from generating a root certificate of their own.

Then we generate a certificate:

$ openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1825 -out myCA.pem

You will be prompted for the passphrase of your private key (that you just chose) and a bunch of questions. The answers to those questions aren’t that important. They show up when looking at the certificate, which you will almost never do. I suggest making the Common Name something that you’ll recognize as your root certificate in a list of other certificates. That’s really the only thing that matters.

You should now have two files: myCA.key (your private key) and myCA.pem (your root certificate).

Congratulations, you’re now a CA!! Sort of. To become a real CA, you need to get your root certificate on all the devices in the world. But for starters do it with the ones you own.

Creating CA-Signed Certificates for your site(s)

Now that we’re a CA on all our devices, we can sign certificates for any new sites that need HTTPS for. First, let’s create the private key:

$ openssl genrsa -out dev.nashutt.com.key 2048

Then we create a CSR:

$ openssl req -new -key dev.nashutt.com.key -out dev.nashutt.com.csr

You’ll get all the same questions as you did above and, again, the answers don’t matter. In fact, they matter even less because no one will be looking at this certificate in a list next to others.

Now we create the configuration file. The config file is needed to define the Subject Alternative Name (SAN). The configuration file dev.nashutt.com.ext contains the following:

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = dev.nashutt.com

We’ll be running the openssl x509 command to sign with the root certificate and private key. I found this example config file on Stack Overflow and it seems to work.

Now we run the command to create the certificate:

$ openssl x509 -req -in dev.nashutt.com.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial \
-out dev.nashutt.com.crt -days  1825 -sha256 -extfile dev.nashutt.com.ext

And that’s it! Now we have three files: dev.nashutt.com.key (the private key), dev.nashutt.com.csr (the certificate signing request), and dev.nashutt.com.crt (the signed certificate).

Shell script

To simplify and speed up things, here’s a handy shell script you can adapt to your own needs:

#!/bin/sh

if [ "$#" -ne 1 ]
then
  echo "Usage: Must supply a domain"
  exit 1
fi

DOMAIN=$1

cd ~/certs

openssl genrsa -out $DOMAIN.key 2048
openssl req -new -key $DOMAIN.key -out $DOMAIN.csr

cat > $DOMAIN.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = $DOMAIN
EOF

openssl x509 -req -in $DOMAIN.csr -CA ../myCA.pem -CAkey ../myCA.key -CAcreateserial \
-out $DOMAIN.crt -days 825 -sha256 -extfile $DOMAIN.ext

Conclusion

So there you have it, how to become your own local certificate authority to sign your local SSL certificates and use HTTPS on your local sites. Hopefully this will eliminate the dreaded ‘Your connection is not private’ message for you in Chrome.