/usr/lib/ssl/misc/ has tools (CA.sh and CA.pl) which can set up a CA.
use: CA.pl -newca
CA.pl -newreq or CA.pl -newcert or "openssl req -new -nodes -keyout newreq.pem -out newreq.pem" or "openssl req -new -nodes -keyout newreq.pem -out newcert.pem"
CA.pl -sign
all of the above combination yield slightly different results.