I have it boiled into a few shell scripts that generate the cnf files needed. OpenSSL has improved its CLI beyond the old Perl script that had long been used for running a local CA and you get fine grained control over what features you want.