After dozen of experiments I finally come to next action sequence with gdb as the most universal/reliable one.

Use openssl to encrypt/decrypt file

openssl aes-256-cbc -salt -in secrets.txt -out secrets.txt.enc
openssl aes-256-cbc -d -in secrets.txt.enc -out

* You will be prompted for a password.

Use openssl to generate self-signed cert 

openssl req -x509 -newkey rsa:1024 -keyout file.pem -out file.crt -days 9999 -nodes

or advanced method

openssl genrsa -out server.key 1024
openssl req -new -key server.key -out server.csr \
       -subj '/C=RU/ST=St.Petersburg/L=St.Petersburg/'
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

make sure you enter right value to CN field

to display cert details

openssl x509 -in cert.pem -noout -text