How to create a root-signed certificate using the -config option?

Question

OpenSSL

Hello. In general, step by step:
I generate a key:
openssl genrsa -out test.key 2048 -sha256
I create a csr using -config conf.ini (it contains domains in the [alt_names] section):
openssl x509 -req -in test.csr -CA rootCA .crt -CAkey rootCA.key -CAcreateserial -out test.crt -days 5000 -sha256
The certificate is created, but there is no alt_names in it. What am I doing wrong?
Ps if I create like this, then all domains are in place:
openssl req -x509 -nodes -newkey rsa:2048 -days 9999 -keyout test.key -out test.crt -config conf.ini, but such a certificate is not signed by the root.

Answer 1

In general, added the section
[ CA_default ]
# Directory and file locations.
dir = /ssl/
private_key = $dir/certs/rootCA.key
certificate = $dir/certs/rootCA.crt
policy = policy_loose
It seemed to help.