<p>I have used the following commands to generate the root certificate and the actual certificate.It says that the certificate is not authorized to sign other certificates.Am I missing something? I am new to these tls certificates</p>
<p>Root certificate:</p>
<pre><code>openssl genrsa -out root-key.pem 2048
openssl req -new -key root-key.pem -subj &quot;/C=IN/ST=RJ/CN=cluster.local/emailAddress=test@foo.com&quot; -out ca.csr
openssl x509 -req -in ca.csr -signkey root-key.pem -CAcreateserial  -out root-cert.pem -days 1000
</code></pre>
<p>Actual certificate:</p>
<pre><code>openssl genrsa -out ca-key.pem 2048
openssl req -new -key ca-key.pem -subj `&quot;/C=IN/ST=RJ/CN=cluster.local/emailAddress=test@foo.com&quot;` -out ca-user-admin.csr
openssl x509 -req -in ca-user-admin.csr -CA root-cert.pem -CAkey root-key.pem -CAcreateserial  -out ca-cert.pem -days 1000
</code></pre>
<p>And for the cert-chain.pem, I am doing <strong>cp root-cert.pem cert-chain.pem</strong></p>
<pre><code>echo &quot;&quot; &gt;&gt; cert-chain.pem 
cat ca-cert.pem &gt;&gt; cert-chain.pem
</code></pre>
<p>I am referring these steps after I created these <a href="https://istio.io/latest/docs/tasks/security/cert-management/plugin-ca-cert/" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/security/cert-management/plugin-ca-cert/</a></p>
<p>Please help me out with this. Am I missing something here ? Or should I get my certificates signed by some other trusted CA ?</p>

jyothi swarup
<p>I was able to generate the certificates using these commands. I am not sure if this is the correct way to do them. After following these steps my istiod was able to sign the workloads with my own CA. After this, I followed the steps given in this page <a href="https://istio.io/latest/docs/tasks/security/cert-management/plugin-ca-cert/" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/security/cert-management/plugin-ca-cert/</a></p>
<pre><code>CONFIG=&quot;
  [req]
  distinguished_name=dn
  [ dn ]
  [ ext ]
  basicConstraints=CA:TRUE,pathlen:0
  &quot;
openssl req -config &lt;(echo &quot;$CONFIG&quot;) -new -newkey rsa:2048 -nodes \
  -subj &quot;/C=IN/O=dEVOPS/OU=DevOps/ST=RJ/CN=cluster.local/emailAddress=test@gmail.com&quot; -x509 -extensions ext -keyout root-key.pem -out root-cert.pem
cp root-cert.pem ca-cert.pem
cp root-key.pem ca-key.pem
cp ca-cert.pem cert-chain.pem
</code></pre>
