openssl genpkey -algorithm ML-DSA-87 -out rootCA.key

openssl req -new -x509 -key rootCA.key -out rootCA.crt -days 999000 -subj "/CN=Post-Quantum Root CA" -addext keyUsage=critical,keyCertSign

cat rootCA.key rootCA.crt > mitmproxy-ca.pem