Below are the commands

openssl genrsa -out rootCA.key 4096
penssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1825 -out rootCA.pem -config opensslf
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -config opensslf
openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 825 -sha256

The last command generates the csr but it is self signed. Verify using openssl verify -CAfile rootCA.pem server.crt results in

(venv) chuwi% openssl verify -CAfile rootCA.pem server.crt                                      
C = IN, ST = KARNATAKA, L = BENGALURU, O = Monallabs, OU = Cloudworks, CN = monallabs.in
error 29 at 1 depth lookup:subject issuer mismatch
C = IN, ST = KARNATAKA, L = BENGALURU, O = Monallabs, OU = Cloudworks, CN = monallabs.in
error 29 at 1 depth lookup:subject issuer mismatch
C = IN, ST = KARNATAKA, L = BENGALURU, O = Monallabs, OU = Cloudworks, CN = monallabs.in
error 29 at 1 depth lookup:subject issuer mismatch
server.crt: verification failed: 29 (subject issuer mismatch)

Not really sure whats going wrong here. In fact the server.crt is self signed:

openssl verify -CAfile server.crt server.crt 
server.crt: OK