Phew…

openssl req -new -newkey ... -extensions v3_req -addext 'subjectAltName=DNS:x.domain.com'

In '/usr/lib/ssl/openssl.cnf'
copy_extensions = copy