assuming CA is already initialized
CONSUL_DC="swarm"
SERVER_CN="server.${CONSUL_DC}.consul"
SERVER_SAN="DNS: *.example.com, DNS: server.${CONSUL_DC}.consul, DNS:localhost"
CLIENT_CN="client.${CONSUL_DC}.consul"
CLIENT_SAN="DNS: *.example.com, DNS: client.${CONSUL_DC}.consul, DNS:localhost"
./easyrsa --subject-alt-name="${SERVER_SAN}" gen-req "${SERVER_CN}" nopass