It is not possible to specify a SAN in OpenSSL solely at the command line*.
FWIW, I wrote a wrapper that allows you to do that by dynamically generating a temporary openssl.cnf behind the scenes for you: one_genkey
A script for creating Certificate Signing Requests from the CLI,
hiding the OpenSSL config file complexity.
*Per dave_thompson_085's ...
This logic is in the configuration (i.e. openssl.cnf) only.
There is likely something like countryName = match in it. It makes sense to have such policy for a company CA where the company is only in a single state (and such policy is often together with organizationName = match). But it does not make sense for a some globally acting CA which issues ...
You put self signed with a question mark without making clear if you understand what it means, namely a cert signed by the same key it contains (not just one you signed or caused to be signed). Or to be more exact, a cert signed by the private half of the keypair whose public half is contained in the cert, so that it verifies with its own key, although that ...
Well, as I was pointed at nginx mailing list, nginx removes all environment variables inherited from its parent process except the TZ variable, so once I defined needed variables in nginx.conf
keys started being recorded as expected.