/p><pre class="programlisting">
openssl x509 -req -in root.csr -text -days 3650 \
  -extfile /etc/ssl/openssl.cnf -extensions v3_ca \
  -signkey root.key -out root.crt
</pre><p>
    Finally, create a server certificate signed by the new root certificate
    authority:
</p><pre class="programlisting">
openssl req -new -nodes -text -out server.csr \
  -keyout server.key -subj "/CN=<em class="replaceable"><code>dbhost.yourdomain.com</code></em>"
chmod og-rwx server.key

openssl x509 -req -in server.csr -text -