Generate new ca certificate (BSD)

$ openssh genrsa -aes256 cacert.key 4096

$ openssl req -x509 -new -nodes -key cacert.key -sha256 -days 365 -out cacert.pem

 

Now you can use cacert.pem as the certificate authority for generating certs for vpn, ldap, WiFi and such

---