cd /etc/apache2 ; mkdir CA
nano /etc/ssl/openssl.cnf
mkdir -p CA/{certs,crl,newcerts,private}
echo 00 > CA/serial  #  WARNING:  You *must* change the serial number if you have more than one server; use 00, 01, 02 ,etc...
touch CA/index.txt
openssl req -new -x509 -keyout CA/private/cakey.pem -out CA/cacert.pem -days 3654 # Create CA Key
openssl req -new -keyout CA/wildcard.req -out CA/wildcard.req -days 3654 # Create WildCard
openssl ca -policy policy_anything -out CA/wildcard.crt -infiles CA/wildcard.req # Sign the Key

openssl rsa < CA/wildcard.req > CA/wildcard.key # Remove the password protection ...

# Also read this:
# http://it.toolbox.com/blogs/securitymonkey/howto-securing-a-website-with-client-ssl-certificates-11500