- fetch public certificate to a website
openssl s_client -connect example.com:443 -showcerts </dev/null 2>/dev/null | openssl x509 -outform PEM > ca.crt
- generate self-signed certificate
openssl req -newkey rsa:2048 -nodes -keyout client.key -x509 -days 365 -out client.crt