Openssl new

https://serverfault.com/questions/670725/is-it-possible-to-restrict-the-use-of-a-root-certificate-to-a-domain

Create private key and encrypt with -aes256

openssl genpkey -aes256 -algorithm RSA -out private_encrypted.key -pkeyopt rsa_keygen_bits:2048