What openssl command will generate a selfsigned test certificate?

The openssl req command creates a CSR, but when combined with the -x509 option, it generates a self-signed certificate directly instead of a CSR. The new option indicates it's a new certificate, key privkey.pem specifies the private key to sign the certificate itself, out cacert.pem is the output file, and days 365 sets the certificate's validity period.

There is no openssl sign subcommand for this purpose; signing is typically part of other openssl operations like req or x509.

Omitting the x509 option would generate a Certificate Signing Request (CSR) instead of a self-signed certificate.

This option uses the non-existent openssl sign subcommand.