You can generate your own CA certificate, and then use that to generate SSL certificates. Typical organisations who need their own CA will create a root CA wit

You can generate your own CA certificate, and then use that to generate SSL certificates. Typical organisations who need their own CA will create a root CA with a 20 to 30 year lifetime. This CA is then used to sign a sub-CA (sometimes called Principal CA, or Issuance CA), with a lifetime of 5-10 years. The sub-CA is then used to sign a TLS cert, with a lifetime of 1-2 years. This means that you only trust the root CA. Whether the TLS certificate gets compromised or not is irrelevant and completely besides the point, because the CA doesn't get compromised, and can revoke the compromised certificates. I can go into detail about a few banks and governments whose CA I setup. Especially the smart card/PIN code distribution to unlock the root CA and sub-CAs was fun.