All information contained in this post comes from the SSL FAQ.

Create RSA private key

openssl genrsa -des3 -out server.key 512|1024|2048
(openssl rsa -noout -text -in server.key)

Create Certificate Signing Request (CSR)

openssl req -new -key server.key -out server.csr
(openssl req -noout -text -in server.csr)

Create own Certificate of Authority (CA) key

openssl genrsa -des3 -out ca.key 512|1024|2048
(openssl rsa -noout -text -in ca.key)

Create self-signed CA certificate

openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
(openssl x509 -noout -text -in ca.crt)

Sign the server CSR and create a server certificate

openssl x509 -req -in server.csr -out server.crt -CA ca.cert -CAkey ca.key -CAcreateserial -days 3650

(Optional) Remove pass-phrase dialog (useful for Apache)

cp server.key server.key.org openssl rsa -in server.key.org -out server.key chmod 400 server.key

Buying a valid certificate

Follow the first two steps above Go to Instant SSL and order cert
(optional) Perform the last step once certificate received