openssl.cnf may not end with a newline. The section [SAN] will then not be found as it is added to the last line of openssl.cnf.