Creating new root certificate

In SSL communication you would need a certificate signed by recognized CA. You can generate the new certificate, but if it is not signed  by root certificate it would not be excepted. Is this possible to generate a root certificate without having access to recognized CA. The answer is yes

makecert -sv SignRoot.pvk -cy authority -r signroot.cer -a
    sha1 -n "CN=Dev Certification Authority" -ss my -sr localmachine

See article SSL with Self-hosted WCF Service for more detail. It also shows how to generate new certificate, sign it by the root certificate and associate it with a port.