openssl x509 uses
-extfile, the command you are using,
openssl req, needs
-config to specify the configuration file.
So, you might use a command like this:
openssl req -x509 -config cert_config -extensions 'my server exts' -nodes \
-days 365 -newkey rsa:4096 -keyout myserver.key -out myserver.crt
The usual prompts for the distinguished name bits are defined in the default configuration file (which is probably
/System/Library/OpenSSL/openssl.cnf on OS X), but this file is not processed when you use
-config, so your configuration file must also include some DN bits. Thus, the above-referenced
cert_config might look something like this:
[ req ]
prompt = no
distinguished_name = my dn
[ my dn ]
# The bare minimum is probably a commonName
commonName = secure.example.com
countryName = XX
localityName = Fun Land
organizationName = MyCo LLC LTD INC (d.b.a. OurCo)
organizationalUnitName = SSL Dept.
stateOrProvinceName = YY
emailAddress = firstname.lastname@example.org
name = John Doe
surname = Doe
givenName = John
initials = JXD
dnQualifier = some
[ my server exts ]
extendedKeyUsage = 18.104.22.168.22.214.171.124.1
# 126.96.36.199.188.8.131.52.1 can also be spelled serverAuth:
# extendedKeyUsage = serverAuth
# see x509v3_config for other extensions
As indicated in the comment, you can probably leave out most of the DN fields. For HTTPS usage, I think all you need is a CN that matches your hostname.
The Distinguished Name and Attribute Section Format section of req(1) shows how you could modify the above configuration to prompt for values (and provide default values) if you wanted to generate multiple similar certificates/requests.
If you need other certificate extensions, check
for what other bits you can specify in extension sections.