Link between openssl 'req' command and 'unable to get local issuer certificate'? I was using the following command to build a self-signed certificate after creating a private key:

openssl x509 -in "server.csr" -out "server.crt" -req -signkey "myprivate.key" -days 365

After some ensuing troubles, and lots of googling I cobbled together a script, which culminated in:

openssl req -config ${CONFIGFILE} -new -x509 -sha256 -newkey rsa:2048 -nodes -keyout "server.key" -days 365 -out "server.crt"

How does this work, given I'm no longer passing it my "myprivate.key" to actually self-sign the cert?

Is "server.key" now being used to do the signing, and do I need to somehow combine this new key with the original "myprivate.key" to create a keychain? I ask since commandline tools don't seem to like the resulting certificate (e.g. curl says: 'SSL certificate problem: unable to get local issuer certificate').
Your second command generates a new RSA key and writes it in server.key, along with the self-signed certificate in server.crt.