
   </p><p>
    It is also possible to create a chain of trust that includes
    intermediate certificates:
</p><pre class="programlisting">
# root
openssl req -new -nodes -text -out root.csr \
  -keyout root.key -subj "/CN=<em class="replaceable"><code>root.yourdomain.com</code></em>"
chmod og-rwx root.key
openssl x509 -req -in root.csr -text -days 3650 \
  -extfile /etc/ssl/openssl.cnf -extensions v3_ca \
  -signkey root.key -out root.crt

# intermediate
openssl req -new -nodes -text -out intermediate.csr