The PowerShell
New-SelfSignedCertificate
cmdlet creates X.509 certificates and private key/public key pairs.
You can save the private key to disk and then use it to issue and sign new certificates, thus simulating a hierarchy of chained certificates.
The cmdlet is intended for use only as an aid when developing services and should never be used to create certificates for actual deployment.