Make a CSR with openssl

make CSR

 
openssl genrsa -des3 -out server.key 2048
openssl rsa -in server.key -out server.key
openssl req -sha256 -new -key server.key -out server.csr -subj '/CN=localhost'
# next line signs the cert - not necessary if a CA is signing simply grab the csr file from above
openssl x509 -req -sha256 -days 365 -in server.csr -signkey server.key -out server.crt
#Replace 'localhost' with whatever domain you require. You will need to run the first two commands one by one as openssl will prompt for a passphrase.

#To combine the two into a .pem file:

cat server.crt server.key > cert.pem