create private key with password protected:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -aes-128-cbc -out fd.key 

show private key info:

openssl pkey -in fd.key -text -noout 

generate pub key:

openssl pkey -in fd.key -pubout -out fd-public.key

create the CSR from config file:

openssl req -new -config fd.cnf -key fd.key -out fd.csr

creating CSRs from existing certificates:

openssl x509 -x509toreq -in fd.crt -out fd.csr -signkey fd.key -copy_extensions copyall

create certificate from CSR:

openssl x509 -req -in fd.csr -CA ca.crt -CAkey intermediate.key -CAcreateserial -out out.crt -copy_extensions copyall -days 3650

sign root CA with new private key:

openssl x509 -in CA.crt -signkey root.key -days 3650