Create a local CA certificate

A root CA certificate is self-signed. Subject and issuer are the same entity, and the signature comes from its own private key. Nothing above it vouches for it. It becomes trusted only when someone adds it to a trust store on purpose.

That’s the whole trick behind every root on your machine. Someone decided to trust it, and everything signed by it inherits that decision. We’re building a lab CA, so this time we get to make that decision ourselves, in a contained way.

Let’s create a short-lived root with the key from the previous lesson:

openssl req -x509 -new -key lab-ca.key -sha256 -days 30 -out lab-ca.crt -subj '/CN=Practical TLS Lab CA'

-x509 tells req to output a self-signed certificate instead of a signing request. -days 30 keeps the root short-lived, on purpose: a learning CA should expire soon after you stop using it. -subj sets the identity inline, so OpenSSL doesn’t prompt for country and organization fields we don’t need.

Now let’s inspect what we made:

openssl x509 -in lab-ca.crt -noout -subject -issuer -dates
# subject=CN=Practical TLS Lab CA
# issuer=CN=Practical TLS Lab CA
# notBefore=Sep  8 16:45:22 2026 GMT
# notAfter=Oct  8 16:45:22 2026 GMT

Subject and issuer are identical. That’s what self-signed means, in one screen.

Check the basic constraints too:

openssl x509 -in lab-ca.crt -noout -ext basicConstraints
# X509v3 Basic Constraints: critical
#     CA:TRUE

CA:TRUE marks this certificate as an authority allowed to sign other certificates. req -x509 sets it for you. Clients reject a chain where a CA:FALSE certificate tried to act as a signer, so this flag matters when we issue the server certificate later.

Now we have two files with very different jobs. lab-ca.crt is public. We’ll hand it to curl and to Node so they can trust what we sign. lab-ca.key is the secret. Keep it where it is, and only touch it when you sign something.

The security lesson underneath all this: never install a root certificate you don’t know. A trusted root can sign certificates for any name. When a tool asks you to install its root CA, it’s asking for the power to impersonate every website you visit. Our lab root gets trusted per command only, and you’ll see how in a later lesson.