To create CA:
1) Generate new key and cert with password:
   openssl req -new -x509 -keyout private/cakey.pem -out CA/cacert.pem -days 365 -config ./openssl.cnf

2) Initialize serial number
   echo '100001' > CA/serial

2) Init cert db
   touch CA/certindex.txt

3) Open CA/cacert.pem on OSX and trust it in the keychain.


To issue new certificate:
1) Generate new RSA private key:
   openssl genrsa -out private/ssl.key 4096

2) Make a new certificate request:
   openssl req -new -out ./ssl.req -key private/ssl.key -config ./openssl.cnf

3) (optional) Check request for Subject Alternative Name info (SAN)
   openssl req -text -noout -in ./ssl.req

4) Issue new cert from CA:
   openssl ca -in ssl.req -out ssl.cert -config openssl.cnf -extensions v3_req

5) (optional) Verify SAN in output cert:
   openssl x509 -in ssl.cert -noout -text

6) (optional) Verify trust:
   openssl verify -CAfile CA/cacert.pem ssl.cert

To create CA:
1) Generate new key and cert with password:
   openssl req -new -x509 -keyout private/cakey.pem -out CA/cacert.pem -days 365 -config ./openssl.cnf

2) Initialize serial number
   echo '100001' > CA/serial

2) Init cert db
   touch CA/certindex.txt

3) Open CA/cacert.pem on OSX and trust it in the keychain.


To issue new certificate:
1) Generate new RSA private key:
   openssl genrsa -out private/ssl.key 4096

2) Make a new certificate request:
   openssl req -new -out ./ssl.req -key private/ssl.key -config ./openssl.cnf

3) (optional) Check request for Subject Alternative Name info (SAN)
   openssl req -text -noout -in ./ssl.req

4) Issue new cert from CA:
   openssl ca -in ssl.req -out ssl.cert -config openssl.cnf -extensions v3_req

5) (optional) Verify SAN in output cert:
   openssl x509 -in ssl.cert -noout -text

6) (optional) Verify trust:
   openssl verify -CAfile CA/cacert.pem ssl.cert


To revoke (e.g. need to update IP address):
   openssl ca -revoke ./CA/certs/100001.pem -config openssl.cnf

Add notes about revoking cert.
Add notes about revoking cert.
