Openssl without openssl.cnf

With but simple

• https://serverfault.com/questions/571910/how-to-add-extended-key-usage-string-when-generating-a-self-signed-certificate-u

https://stackoverflow.com/questions/36920558/is-there-anyway-to-specify-basicconstraints-for-openssl-cert-via-command-line

DAYS='240'
SUBJECT='/CN=example.com/O=Example Co./OU=Engineering/L=Boston/ST=MA/C=US'
SERIAL='0x1001'

openssl req \
    -addext basicConstraints=critical,CA:TRUE,pathlen:1 \
    -outform pem -out cacert.pem \
    -key privkey.pem -new -x509 \
    -days "${DAYS}" \
    -subj "${SUBJECT}" \
    -set_serial "${SERIAL}"

-CAcreateserial

serial

https://stackoverflow.com/questions/66357451/why-does-signing-a-certificate-require-cacreateserial-argument