Adapted from Paul Bramscher’s much more complete guide, which you should probably consult instead. Or you might just check Stack Overflow.

openssl genrsa -des3 -out server.key 4096 
openssl req -new -key server.key -out server.csr 
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt 
openssl rsa -in server.key -out server.key.insecure
mv server.key server.key.secure
mv server.key.insecure server.key