To sign a CA with the key:
openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt
openssl x509 -req -in cert.csr -CAkey ca.key -CA ca.crt -out cert.crt