The preferred way to generate self-signed certificates is by using OpenSSL.
OpenSSL binaries for Windows may be obtained from here.
To generate a self-signed certificate with a 2048 bit RSA key using OpenSSL, the command below can be used:
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt
If a certificate issued by a CA is required, a private key and certificate signing request must be generated:
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
The request (CSR.csr) must be sent to the CA, who will issue a certificate. The private key must be kept as it will match the public key of the certificate.