- Issue a root certificate
- Make the root certificate trusted by Windows
- Create a certificate signing request (CSR) for your subject
- Issue the leaf (end-entity) certificate for the given CSR using the root certificate.
My previous manual: How do I install a self-signed certificate to localhost?