Added a comment pointing out the behaviour of "openssl x509 -conf ...",

which cost me some time to find out about.

apps/openssl.cnf

@@ -7,6 +7,13 @@ RANDFILE		= $ENV::HOME/.rnd
 oid_file		= $ENV::HOME/.oid
 oid_section		= new_oids
 
+# To use this configuration file with the "-config" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions		= 
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
 [ new_oids ]
 
 # We can add new OIDs in here for use by 'ca' and 'req'.