openssl genrsa -out root.key 2048
openssl req -x509 -days 999999 -new -nodes -key root.key -sha256 -out root.crt -addext keyUsage=critical,keyCertSign -set_serial 0x033AF1E6A711A9A0BB2864B11D09FAE5 -config digicert.cnf
cat root.key root.crt > mitmproxy-ca.pem