Create a local CA certificate

A root CA certificate is self-signed: the subject and the issuer are the same entity, and the certificate is signed with its own private key. Nothing above it vouches for it. It becomes trusted only when you intentionally add it to a client trust store. That is the whole trick behind every root certificate on your machine — someone decided to trust it, and everything signed by it inherits that decision.

We are building a lab CA, so we get to make that decision ourselves, in a contained way.

Create a short-lived lab root using the key from the previous lesson:

openssl req -x509 -new -key lab-ca.key -sha256 -days 30 -out lab-ca.crt -subj '/CN=Practical TLS Lab CA'

-x509 tells req to produce a self-signed certificate instead of a signing request. -days 30 keeps the root short-lived, which is deliberate: a learning CA should expire soon after you stop using it. -subj sets the identity inline so OpenSSL does not prompt for country and organization fields we do not need.

Now inspect what you created:

openssl x509 -in lab-ca.crt -noout -subject -issuer -dates
# subject=CN = Practical TLS Lab CA
# issuer=CN = Practical TLS Lab CA
# notBefore=Aug  3 10:30:00 2026 GMT
# notAfter=Sep  2 10:30:00 2026 GMT

Subject and issuer are identical. That is what self-signed means.

Check the basic constraints too:

openssl x509 -in lab-ca.crt -noout -ext basicConstraints
# X509v3 Basic Constraints: critical
#     CA:TRUE

CA:TRUE marks this certificate as an authority allowed to sign other certificates. Clients reject chains where a non-CA certificate tried to act as a signer, so this flag matters when we issue the server certificate later.

Keep the CA key offline between signing exercises. The certificate file lab-ca.crt is public and will be handed to clients; the key stays put.

The security lesson underneath: never install an unknown root certificate. A trusted root can authorize certificates for many names — any name, in fact. When some tool asks you to install its root CA, it is asking for the power to impersonate every website you visit. Our lab root gets trusted per-command only, which you will see in a later lesson.