generate key、crt、CA

server:

    openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr
    openssl x509 -req -in server.csr -signkey server.key -out server.crt

client:

openssl req -new -newkey rsa:2048 -nodes -keyout client.key -out client.csr
openssl x509 -req -in client.csr -signkey client.key -out client.crt

CA:

cat server.crt client.crt > ca.pem