title: What is the difference between req_extensions in config and -extensions on command line?
body: <p>The sample openssl root ca config from the <a href="https://www.feistyduck.com/books/openssl-cookbook/" rel="nofollow">OpenSSL Cookbook</a> defines the following (p40):</p>
  
  <pre><code>[req]
  ...
  req_extensions = ca_ext
  
  [ca_ext]
  ...
  </code></pre>
  
  <p>Later (p43), the root ca key is generated, then the root ca selfsigned cert. </p>
  
  <pre><code>openssl req -new \
  -config root-ca.conf \
  -out root-ca.csr \
  -keyout private/root-ca.key
  
  openssl ca -selfsign \
  -config root-ca.conf \
  -in root-ca.csr \
  -out root-ca.crt \
  -extensions ca_ext
  </code></pre>
  
  <p>Isn't req_extensions redundant in this specific use case? 
  When is req_extension really needed?</p>