If you follow this guide to setup your own CA and your certificate requests contain subjectAltNames (i.e. to match multiple virtual hosts with the same certificate), don’t forget to add
copy_extensions = copy
under the [ CA_default ] section of the default openssl.cnf file. Took me a while to realize…
Happy signing!