We tried to generate our own custom certs via OpenSSL, but can't seem
to get it to work.

Here's what we did to try things, but WSE always complains about
validating the signing/encryption ("Exception thrown: The security
token could not be authenticated or authorized") --

- Create our own test CA
CA.pl -newca

- Import the test CA into the trusted CA store for localmachine

- Create our own pub/priv key pair and generate sign request
CA.pl -newreq

- Sign it
CA.pl -sign

- Export as PKCS12
CA.pl -pkcs12

- Import PCKS12 file into My store.

We also found an article

http://www.javakb.com/Uwe/Forum.aspx/java-security/89/NET-WSE-and-Java-security-
WS-Security-interop

to make sure OpenSSL is configured so that the "KeyUsage" includes
certain options.  We enabled this by modifying openssh.cnf so that
keyUsage = "critical, nonRepudiation, digitalSignature,
keyEncipherment, dataEncipherment".

Altering the keyUsage values does indeed affect the key generation, but
only that it adds these values to an attribute in the certificate
itself.

Any thoughts on generating your own OpenSSL certificates?  Are there
any how-tos on generating your own?

Thanks in advance,
Dustin