I have a LAN HTTPS server that I want to give an SSL certificate to. Since it's local-only, a self-signed certificate is sufficient for me. I have previously given it a self-signed root certificate, which has worked fine.
However, if the key of that root certificate is stolen, an attacker can sign certificates for e.g. www.google.com, and my computer (not everyone's) would trust it (since it trusts the self-signed root certificate), and visit the attacker's website instead. And I would not be able to notice this.
Therefore I want to create a self-signed certificate that can only be used by the server to prove it's identity. So even if my computer trusts that certificate, it won't trust certificates signed by that certificate.
Preferably I want to use this one-liner I recently found:
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
but modify it to limit the key usage, to take into account what I wrote above.
I found these key usages and extended key usages from a tutorial. Will they achieve what I want?
keyUsage = critical, digitalSignature, keyEncipherment extendedKeyUsage = serverAuth