openssl self-signed certificate creation for web server

gen.sh

set -e

if [ -z "$1" ]; then
  hostname="$HOSTNAME"
else
  hostname="$1"
fi

local_openssl_config="
[req]
prompt = no
x509_extensions = v3_req
distinguished_name = dn

[v3_req]
basicConstraints = CA:true
subjectAltName = @alt_names
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

[dn]
CN = $hostname

[alt_names]
DNS.1 = $hostname
DNS.2 = *.$hostname
"

openssl req \
  -newkey rsa:2048 -nodes \
  -keyout "$hostname.key" \
  -x509 -sha256 -days 3650 \
  -config <(echo "$local_openssl_config") \
  -out "$hostname.crt"