OpenSSL self-signed certificates with subjectAltName for Thunderbird

name="Some One"
email="someone@example.net"
days=1827 # validity of the certs, 5 years = 1827 days (roughly;)
cc="AT"
state="Vienna"
city="Vienna"
organization="example.net"
org_unit=""

# email addresses that should be included in the certificate
export san=email:other@example.net,email:other@example.com

# 2 more variables (subj + exts) just to shorten some of the other commands

## build string for openssl `-subj` parameter
subj="/C=$cc/ST=$state/L=$city/O=$organization"
test -n "$org_unit" && subj="$subj/OU=$org_unit"
subj="$subj/CN=$name/emailAddress=$email"

## x509v3 certificate extensions as common these days
exts="basicConstraints = CA:false"
exts="$exts \n extendedKeyUsage = emailProtection"
exts="$exts \n subjectKeyIdentifier = hash"
exts="$exts \n authorityKeyIdentifier = keyid,issuer"

# a directory to work in
mkdir selfsigned-certs
cd selfsigned-certs

# a privacy minimum
umask 0077

# set up a directory, database + filenames for the CA
cadir="CA"
mkdir -p "$cadir"/newcerts
echo "1337" >"$cadir"/serial
touch "$cadir"/index.txt "$cadir"/index.txt.attr
cakey="$cadir/CA.key"
cacrt="$cadir/CA.crt"

cat >minimal.cnf <<'EOF'
[ca]
default_ca = ca
dir = ./CA
private_key = $dir/CA.key
certificate = $dir/CA.crt
new_certs_dir = $dir/newcerts
database = $dir/index.txt
serial = $dir/serial
default_md = default

unique_subject = no
copy_extensions = copyall
policy = policy_empty

[policy_empty]

[req]
distinguished_name = req
EOF

openssl genrsa -aes128 -out "$cakey" 4096
# about -aes128 cf. https://security.stackexchange.com/q/14068
openssl req -new -key "$cakey" -x509 -out "$cacrt" -config minimal.cnf \
  -days $days -subj "$subj"
# optionally check contents of CA certificate
openssl x509 -text -in "$cacrt" | less

openssl req -new -newkey rsa:2048 -keyout $email.key \
  -out $email.req -subj "$subj" ${san:+-reqexts san} \
  -config <(echo '[req]'; echo 'distinguished_name=req'; echo '[san]';
  echo "subjectAltName=email:copy${san:+,\${ENV::san\}}")
openssl ca -out $email.crt -days $days -in $email.req \
  -extfile <(printf "$exts") -config minimal.cnf -preserveDN
# optionally check contents of the certificate
openssl x509 -text -in $email.crt | less
# generate a PKCS#12 export for the email address
openssl pkcs12 -export -in $email.crt -inkey $email.key -out $email.p12
# clean up
rm $email.req