# Create a private key for the root CA
openssl genpkey -algorithm RSA -out root_ca.key -pkeyopt rsa_keygen_bits:2048

# Create a self-signed root CA certificate
openssl req -x509 -new -nodes -key root_ca.key -sha256 -days 1825 -out root_ca.crt -subj "/C=US/ST=State/L=City/O=tlsnotary/OU=IT/CN=tlsnotary.org"

# Create a private key for the end entity certificate
openssl genpkey -algorithm RSA -out test_server.key -pkeyopt rsa_keygen_bits:2048

# Create a certificate signing request (CSR) for the end entity certificate
openssl req -new -key test_server.key -out test_server.csr -subj "/C=US/ST=State/L=City/O=tlsnotary/OU=IT/CN=test-server.io"

# Sign the CSR with the root CA to create the end entity certificate
openssl x509 -req -in test_server.csr -CA root_ca.crt -CAkey root_ca.key -CAcreateserial -out test_server.crt -days 825 -sha256 -extfile openssl.cnf -extensions v3_req

# Convert the root CA certificate to DER format
openssl x509 -in root_ca.crt -outform der -out root_ca_cert.der

# Convert the end entity certificate to DER format
openssl x509 -in test_server.crt -outform der -out test_server_cert.der

# Convert the end entity certificate private key to DER format
openssl pkcs8 -topk8 -inform PEM -outform DER -in test_server.key -out test_server_private_key.der -nocrypt