title: How to use OpenSSL for self-signed certificates with custom CA and proper SAN settings?
body: <p>I run across this topic once in a while, trying to remember how this was done then find all the incomplete answers again (with config files, oneliners,ignoring that we really want to use a custom CA to create a full certificate chain etc.). And many answers applying SAN for the certificate request, but messing SAN up in the signing command...</p>
  <p>What I want to do?</p>
  <ol>
  <li>Create a custom CA</li>
  <li>Create a certificate request.</li>
  <li>Sign the certificate request.</li>
  <li>Create a chain file</li>
  <li>Additional steps in Firefox/Chrome (yes, Chrome needs SAN)</li>
  </ol>
  <p>(Yes, please don't do everything in one command, I want my CA reside on another machine)
  (Yes, this might again be incomplete for somebody else. But this is exactly what I need 1-2 times a year, when a simple self-signed cert in my DEV environment, I simply trust by configuration, is not enough)
  (Yes, you might want to implement additional validation steps, if you are not the one requesting and signing certificates as one person)</p>