# Link between openssl 'req' command and 'unable to get local issuer certificate'?

I was using the following command to build a self-signed certificate after creating a private key:

openssl x509 -in "server.csr" -out "server.crt" -req -signkey "myprivate.key" -days 365

After some ensuing troubles, and lots of googling I cobbled together a script, which culminated in:

openssl req -config \${CONFIGFILE} -new -x509 -sha256 -newkey rsa:2048 -nodes -keyout "server.key" -days 365 -out "server.crt"

How does this work, given I'm no longer passing it my "myprivate.key" to actually self-sign the cert?

Is "server.key" now being used to do the signing, and do I need to somehow combine this new key with the original "myprivate.key" to create a keychain? I ask since commandline tools don't seem to like the resulting certificate (e.g. curl says: 'SSL certificate problem: unable to get local issuer certificate').

Your second command generates a new RSA key and writes it in server.key, along with the self-signed certificate in server.crt.

• Hi @conrado, I'm going to accept your answer since server.key is indeed a net new key. With regard to the part of my question about 'Do i need to somehow combine....' ... I learned later that what I needed was a separate self-signed key, acting as a CA, to sign this server request. Hope it helps someone else. – yen Feb 28 '18 at 1:20