Check out https://smallstep.com/ if you want to go the self-signed root CA route.

They have some really nice tools and some good articles for learning.