issuer contains the CA' serial number, thus making CA rollover trickier (you'd
need to issue a new cert with the same serial). Having only keyid allows for
easier CA rollover.

mox isn't python3 ready (syntax error) thus restrict to 2

don't put the CA password on the command line, pass it in to openssl via stdin

setting unique_subject = no allows for key rollovers:

  if the value yes is given, the valid certificate entries in the database must
  have unique subjects. if the value no is given, several valid certificate
  entries may have the exact same subject. The default value is yes, to be
  compatible with older (pre 0.9.8) versions of OpenSSL. However, to make CA
  certificate roll-over easier, it's recommended to use the value no,
  especially if combined with the -selfsign command line option.