On macOS 10.14.3, the step “Create new certificate using rootSSL certificate” didn’t work. Thankfully, Maksim Diakonov had the solution (I put it all in one line):

openssl x509 -req -in demo.local.csr -CA rootSSL.pem -CAkey rootSSL.key -CAcreateserial -out demo.local.crt -days 3650 -sha256 -extfile <(echo “ [ v3_ca ]\n authorityKeyIdentifier=keyid,issuer\n basicConstraints=CA:FALSE\n keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment\n subjectAltName=DNS:demo.local “)