Create internal certificate

Install CA on 2012 or 2008.
https://stealthpuppy.com/deploy-enterprise-root-certificate-authority/#.XIUHk6Izbcs
https://www.youtube.com/watch?v=vhLPwtO_BBc

Create CSR
https://tecadmin.net/simple-steps-to-generate-csr-on-centos/
Please check this to enrol
https://docs.centrify.com/en/css/2018-html/index.html#page/Additional_tools_and_topics/Certificate_Auto-enrollment_Quick_Start_Guide.1.html

There's really no reason to run a private CA anymore.

You can go the way MAS suggested, or use real certs from https://LetsEncrypt.org which has been providing free certs for years now.

certbot-auto certonly --no-self-upgrade --non-interactive --rsa-key-size 4096 --email $email --agree-tos --webroot -w /var/www/html -d foo.com -d www.foo.com

Select allOpen in new window

Oops. I missed about letsencrypt. Thanks David.
@Shareef
That is an option for you to avoid maintaining CA/Server.

There's really no reason to run a private CA anymore.

I do not know why you keep saying that, this is totally untrue. It is true however that OP can use letsencrypt for this web server

because the environment not allowed to access the internet .

i need more details about the certificates and what is the difference between the certificate and the root certificate

There are two ways to approach this.

1) Create a root cert + issue your own certs.

2) Use an existing certification system like LetsEncrypt, where LetsEncrypt maintains the root cert.

Rereading your initial question, looks like you're using #1, so your go through the links MAS suggested which cover each step...

Creating a CA. Creating a CSR. Creating a cert using the CSR.

If you opt for using #2, then anytime you require a cert for any net based service, you'll use the certbot-auto client to generate the cert + then deploy the cert to your machines which have no net access (so I'm guessing these are on a private network some way).

Here's how I do this with complex infrastructures...

1) Initially setup a LetsEncrypt wildcard cert.

2) This requires you have access to your DNS zone files or API access, to update TXT records for initial cert generation + renewal.

3) Once you get details of #2 working, certs auto renew forever, so no life becomes very simple.

4) Then each night have an rsync job that runs which pulls any cert update (when renewals occur), then plumb the new cert into whatever service uses the cert...

You have 2x choices of ongoing work for either approach.

With #1 (private CA), you'll have to arrange to regenerate the root cert + any other host certs + deploy them across your machines.

With #2 only consideration is cert redeployment when certs update, so #1 is very hard to automate, #2 takes maybe 1-2 hours of work one time, then everything works automatically forever.

The option you pick will be determined by time + budget you have available.

If you're super busy... you'll likely enjoy #2 for a single outlay of time + zero time thereafter...