openssl genrsa -aes256 -out rootCA.key 4096
openssl req -new -subj "/C=FR/ST=Ille-et-Vilaine/L=Rennes/O=GRIFON/CN=ca.grif/emailAddress=contact@grifon.fr" -key rootCA.key -out rootCA.csr
openssl req -x509 -in rootCA.csr -key rootCA.key -sha512 -days 3650 -out rootCA.crt
openssl x509 -in rootCA.crt -noout -serial > rootCA.srl

openssl genrsa -out mydomain.com.key 4096 openssl req -new -key mydomain.com.key -out mydomain.com.csr

ou en one line :

openssl req -new -sha256 -key mydomain.com.key -subj "/C=FR/ST=Ille-et-Vilaine/L=Rennes/O=GRIFON/CN=mydomain.com/emailAddress=contact@grifon.fr" -out mydomain.com.csr

verify csr :

openssl req -in mydomain.com.csr -noout -text

generate cert :

openssl x509 -req -in mydomain.com.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out mydomain.com.crt -days 500 -sha256

verify cert :

openssl x509 -in mydomain.com.crt -text -noout

source : https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309