I can almost never remember how to make self-signed certs and I feel like I have to read every guide 3-4 times for it to make sense. I'm collecting the wisdom in one place for me to be able to work it out.

self signed certs

# generate private key 
openssl genrsa -aes256 -out fqdn.key 2048

# generate certificate signing request for key
openssl req -new -key fqdn.key -out fqdn.csr

# sign request and generate x509 out (public key)
openssl x509 -req -days 1095 -in fqdn.csr -signkey fqdn.key -out fqdn.crt

# import keys into p12 package
openssl pkcs12 -export -in fqdn.crt -inkey fqdn.key -out fqdn.p12