Es muyyy chorra, pero funciona:
openssl genrsa -des3 -out $1.pem 2048
openssl req -new -key $1.pem -out $1-petic-cert-client.pem
openssl x509 -CA cacert.pem -CAkey cakey.pem -req -in $1-petic-cert-client.pem -set_serial 3 -days 365 -extfile config2.txt -sha1 -out $1-client-cert.pem
openssl pkcs12 -export -in $1-client-cert.pem -inkey $1.pem -certfile cacert.pem -out $1-cert-pck12.p12