openssl genpkey -algorithm RSA -out leaf.key -pkeyopt rsa_keygen_bits:4096

openssl req -new -key leaf.key -out leaf.csr -sha256

openssl req -text -noout -verify -in leaf.csr

openssl x509 -req -in leaf.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out leaf.crt -days 999999 -sha256