# cat > crt.cfg << EOT
[ req ]
default_bits = 4096
encrypt_key = yes
distinguished_name = req_dn
x509_extensions = cert_type
prompt = no
[ req_dn ]
C=RU
ST=ZAZHOPINSK
L=MUHOSRANSK
O=FIRMA
OU=SERVER
CN=firma.ru
emailAddress=admin@firma.ru
[ cert_type ]
nsCertType = server
EOT
# openssl req -new -x509 -nodes -days 9999 -config crt.cfg -out firma.crt -keyout firma.key
# openssl x509 -subject -noout -fingerprint -in firma.crt