[dajiaohuang]

Summary

• Replace x509 -copy_extensions copyall with an explicit, per-invocation extension config passed via -extfile/-extensions, avoiding the unsupported LibreSSL option reported in Local Domains do not work #96.
• Preserve the requested SANs and validate certificate names before writing them to the OpenSSL config.
• Apply the same certificate issuance path in the app and shared daemon package; extend regression coverage for extra SANs and config-injection input.

Validation

• Synthetic OpenSSL command-line smoke with OpenSSL 3.5.4: CA/CSR/leaf issuance via -extfile succeeded, chain verification returned OK, and all expected SANs were present.
• git diff --check passed.
• scripts/build.sh, scripts/test.sh, and the Swift tests were not run: this environment is Windows/Msys without Swift/Xcode; CONTRIBUTING.md specifies Apple Silicon macOS and Xcode 26+.