Create a self-signed X.509 certificate.

        @type hostname: L{unicode}
        @param hostname: The hostname this certificate should be valid for.

        @type serial: L{int}
        @param serial: The serial number the certificate should have.

        @rtype: L{bytes}
        @return: The serialized certificate in PEM format.

def _createCert(self, hostname, serial):
        """
        Create a self-signed X.509 certificate.

        @type hostname: L{unicode}
        @param hostname: The hostname this certificate should be valid for.

        @type serial: L{int}
        @param serial: The serial number the certificate should have.

        @rtype: L{bytes}
        @return: The serialized certificate in PEM format.
        """
        privateKey = rsa.generate_private_key(
            public_exponent=65537,
            key_size=2048,
            backend=default_backend())
        publicKey = privateKey.public_key()
        name = x509.Name([
            x509.NameAttribute(NameOID.COMMON_NAME, hostname)])
        certificate = (
            x509.CertificateBuilder()
            .subject_name(name)
            .issuer_name(name)
            .not_valid_before(datetime.today() - timedelta(days=1))
            .not_valid_after(datetime.today() + timedelta(days=365))
            .serial_number(serial)
            .public_key(publicKey)
            .add_extension(
                x509.BasicConstraints(ca=False, path_length=None),
                critical=True)
            .add_extension(
                x509.SubjectAlternativeName([
                    x509.DNSName(hostname)]),
                critical=False)
            .add_extension(
                x509.KeyUsage(
                    digital_signature=True,
                    content_commitment=False,
                    key_encipherment=True,
                    data_encipherment=False,
                    key_agreement=False,
                    key_cert_sign=False,
                    crl_sign=False,
                    encipher_only=False,
                    decipher_only=False),
                critical=True)
            .add_extension(
                x509.ExtendedKeyUsage([
                    ExtendedKeyUsageOID.SERVER_AUTH]),
                critical=False)
            .sign(
                private_key=privateKey,
                algorithm=hashes.SHA256(),
                backend=default_backend()))
        return '\n'.join([
            privateKey.private_bytes(
                encoding=serialization.Encoding.PEM,
                format=serialization.PrivateFormat.PKCS8,
                encryption_algorithm=serialization.NoEncryption()),
            certificate.public_bytes(
                encoding=serialization.Encoding.PEM),
            ])