Follow these steps:

1. Open /etc/pki/tls/openssl.cnf and locate [CA_default] section, then remove "#" at the start of copy_extentions.

   # Extension copying option: use with caution.

   copy_extensions = copy

   Save the changes.

2. Create an empty index.txt file in the /etc/pki/CA directory using the following command.

   [root@imsva ~]# touch /etc/pki/CA/index.txt

3. Create the serial file with initial content in the /etc/pki/CA directory using the following command.

   [root@imsva ~]# echo "01" > /etc/pki/CA/serial

4. Generate the CA certificate.

   [root@imsva ~]# openssl req -x509 -newkey rsa:2048 -keyout CA_key.pem -out CA_cert.pem -config /etc/pki/tls/openssl.cnf

   Enter a password and provide information when prompted.

5. Sign IMSVA certificate.

   To generate CSR with SANs, refer to < Create a 2048 bit CSR with SANs.docx>

   [root@imsva ~]# openssl ca -days 3650 -cert CA_cert.pem -keyfile CA_key.pem -in imsva.csr -out imsva.pem -config /etc/pki/tls/openssl.cnf

   When prompted for password, type the password set in Step 1.

6. Copy CA_cert.pem, imsva.pem and imsva_key.pem out with WinSCP or other tools.