Create CA and certificates mkdir /root/ca cd /root/ca /usr/share/easy-rsa/easyrsa init-pki /usr/share/easy-rsa/easyrsa build-ca Fill in the CA part (Common Name). Next, generate server certificate. nopass option disables password. /usr/share/easy-rsa/easyrsa build-server-full server-name nopass Next, generate client certificate. /usr/share/easy-rsa/easyrsa build-client-full oneplus6t nopass Certificates are valid 3 years by default. To remove passphrase (if you forgot nopass): openssl rsa ...