[zupreme]

Ignore anyone telling you that what you propose is technically difficult. It is not.

The code for what you want to do has been baked into Windows Server since 2008. It also exists in OpenSSL.

The CA part is easy. The “getting the world to trust your CA” is the part most would call “difficult”.

If you can do the latter, ALOT of people here can do the former, and you will likely succeed.

If you cannot do the latter, you will likely fail in the effort.

[oarsinsync]

The CA part is incredibly easy if you don’t need to consider security.

The difficulty then ramps up the more secure you want (or need) it to be.