Buliding certificate authority

mkdir /etc/ssl
cd /etc/ssl/
mkdir CA
cd CA
mkdir certs crl newcerts private
echo "01" > serial
cp /dev/null index.txt
cp /usr/local/openssl/openssl.cnf.sample openssl.cnf

openssl req -new -x509 -keyout private/cakey.pem -out \
cacert.pem -days 365 -config openssl.cnf

To make a new certificate:

openssl req -nodes -new -x509 -keyout newreq.pem \
-out newreq.pem -days 365 -config openssl.cnf

(certificate and private key in file newreq.pem)

To sign new certificate with certificate authority:

openssl x509 -x509toreq -in newreq.pem -signkey newreq.pem \
-out tmp.pem

openssl ca -config openssl.cnf -policy policy_anything \
-out newcert.pem -infiles tmp.pem

rm -f tmp.pem

(newcert.pem contains signed certificate, newreq.pem still contains
unsigned certificate and private key)

For More info , plz refer here