follow the instructions in http://sial.org/howto/openssl/self-signed/ including the link to create a CA (http://sial.org/howto/openssl/ca/). Then make sure that the files are where your nsopenssl config section says they are.
/Bart
