Most of the following is taken from the OpenSSL cookbook
OpenSSL does not come with any trusted root certificates (also known as a trust store). DL Mozilla's truststore [here](https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins... /certdata.txt). Note: It's in a custom format so needs conversion so use this tool.
- generate a strong private key