Certificate Authority
---------------------
CA Certificate is placed in /etc/ssl/certs/ and name closely to CN of
organisation ( s/ /_/g ) appended "_CA.crt".

CA Key is located in /etc/ssl/private/ named similarly appended
"_CA.key".

Certificate is symlinked to "/etc/ssl/certs/cacert.pem" for easy
locating by scripts.

Hosts
-----
Host certificates are placed in /etc/ssl/certs/ either named by the
service they provide appended ".pem", or symlinked with that name from
hostname.key or whatever makes best sense in the situation, either with
the key embedded or the key at the same place.

The script /usr/share/local/localmksslcerts can be used to make
self-signed certificates with embedded keys.

Users
-----
Have a look at this web page:
http://www.cise.ufl.edu/help/secure-access/ssl-mail-setup.shtml

The script is at /usr/share/local/mycert - adapted to Debian GNU/Linux.