OpenSSL CSR configuration for Subject Alternative Names (SAN)

When generating a Certificate Signing Request (CSR) using the openssl req command, standard subject fields are handled via interactive prompts or a basic configuration file. However, modern browser requirements necessitate the inclusion of Subject Alternative Names (SANs) to ensure certificate validity across multiple DNS entries or IP addresses.

The goal is to integrate these extensions into the CSR generation process without manually editing the global openssl.cnf file for every unique request. While the -config flag allows for a custom configuration file, there is uncertainty regarding the most efficient way to pass dynamic SAN values during a scripted generation process in OpenSSL 3.x.

• Is there a method to inject SAN extensions via the command line without a physical configuration file?
• How does the req_extfile directive behave when multiple SAN entries are required for a single request?