Q:

how to create private key + CSR signed by a custom CA

I am trying to generate a private key + certificate ... certificate need to be signed by CA. 
I generate a CA with openssl, 
key:
openssl genrsa -aes256 -passout pass:xxxx -out ca.pass.key 4096
openssl rsa -passin pass:xxxx -in ca.pass.key -out ca.key

cert:
openssl req -new -x509 -days 3650 -key ca.key -out ca.pem

Now generate client key + cert with keytool ... 
keytool -genkey -alias clientkey -keystore clientkeystore.p12 -keyalg RSA -storetype PKCS12 -validity 3650

Is possible to add sign with CA with Keytool ? 

A:

After generating the key:

Use keytool -certreq to generate a file containing the CSR.
Use openssl x509 -signkey to sign the CSR and generate an X.509 certificate.
Use keytool -importcert to import the signed X.509 certificate; it will be automatically associated with the internally generated private key.

You might want to try tools such as Portecle or Keystore Explorer for Java keystore management.
See other examples:

https://www.digicert.com/csr-creation-java.htm
https://knowledge.digicert.com/generalinformation/INFO227.html
https://www.ibm.com/support/knowledgecenter/en/HW94A/com.ibm.acc.8731.doc/creating_a_java_keystore_mobile_interface.html
https://docs.oracle.com/cd/E19509-01/820-3503/ggezu/index.html
https://www.entrustdatacard.com/knowledgebase/how-do-i-generate-a-2048-bit-csr-using-java-keytool

