openssl x509
  -req
  -CA ca.crt
  -CAkey ca.key
  -set_serial 0x$(openssl rand -hex 16)
  -days 3650
  -extfile <(echo -e "keyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage= serverAuth")
  -in server.csr
  -out server.crt