days 365 \
  -CA root.crt -CAkey root.key -CAcreateserial \
  -out server.crt
</pre><p>
    <code class="filename">server.crt</code> and <code class="filename">server.key</code>
    should be stored on the server, and <code class="filename">root.crt</code> should
    be stored on the client so the client can verify that the server's leaf
    certificate was signed by its trusted root certificate.
    <code class="filename">root.key</code> should be stored offline for use in
    creating future certificates.