code: function openssl_x509(csr, ca_key, ca_cert, options) {
    while (csr && 'string' !== typeof csr) csr = csr.csr
    while (ca_cert && 'string' !== typeof ca_cert) ca_cert = ca_cert.cert
  
    if (!options) options = {}
    if (!csr) throw new Error("Parameter 'csr' is required")
    if (!ca_key) throw new Error("Parameter 'ca_key' is required")
    if (!ca_cert) throw new Error("Parameter 'ca_cert' is required")
  
    if (!options.extensions)
      options.extensions = extensionConfigForOpenSSL(options, 'v3_req')
  
    return Promise.all([
        tmpfile(csr),
        tmpfile(ca_cert),
        tmpfile(options.extensions),
        tmpfile(ec_pem.encodePrivateKey(ca_key)) ])
      .then(tmpList => {
        const [tmp_csr, tmp_ca_cert, tmp_ext, tmp_ca_key] = tmpList
  
        let args = ['x509', '-req', '-sha256']
        args.push('-days', options.days || 1, '-set_serial', options.serial || Date.now().toString())
        args.push('-extensions', 'v3_req', '-extfile', tmp_ext.path)
        args.push('-in', tmp_csr.path, '-CA', tmp_ca_cert.path, '-CAkey', tmp_ca_key.path)
  
        return finallyCleanupTmpList(openssl_stdout(args, 5), tmpList) })}
docs: openssl x509 -req -in «/tmp/.../csr.pem» -CAkey «ec private key»