A digital certificate certifies the ownership of a public key by the named subject of the certificate. This allows other parties to rely upon signatures or on assertions made about the private key that corresponds to the certified public key. A CA acts as a third party trusted both by the owner of the certificate and by the party that relies upon the certificate. The format of these certificates is specified by the X.509 standard.

You will need both a CA root certificate and a server certificate. Place the server certificate only at the server location. Place the CA certificate only at the client side. During a connection, the client sends a hello that contains a list of its ciphers to the server. The server then sends a list of supported ciphers and its server certificate as a response. The client authenticates the server certificate with the CA certificate and generates a symmetric certificate. This symmetric certificate is passed to the server. The server generates its own symmetric certificate. This symmetric certificate is used to create a symmetric cryptography bridge between the client and server, and start an encrypted session.

You can create your own CA certificate and use it to generate a server key and certificate.