I found a root ca install howto but I think requesting letsencrypt is much easier to install and maintain.