What parameters are needed to generate the "correct" SSL certificate?

Question

Digital certificates

I know that the sha-1 hashing algorithm is outdated and sha-2 should be used.
Maybe someone is aware of what parameters you need to generate self-signed certificates so that when you register the root as trusted, the browser does not swear at unstable algorithms and other comments.
Is it possible to put a timestamp on a self-signed certificate?
What is the optimal RSA length?

Answer 1

The minimum RSA key length, which browsers will not swear at now, is 2048. But I recommend making a key of at least 4096 for the root CA. You do
n’t need to use SHA-1, that’s right.
The certificate must always indicate the date and time of creation and expiration.