Use this configuration with OpenSSL. You may add real IP and DNS SAN´s (Subject Alternative Name) below under [ alt_names ]
.
cat <<EOF > openssl.conf
[ req ]
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_ca ]
basicConstraints = critical, CA:TRUE