Generate client certificate with principal name with OpenSSL
<p>I need to generate a client authentication certificate with "NT Principal Name" and "RFC 822 Name" under Subject Alternative Name, similar to this certificate, as shown in macOS keychain access (the obscured field values are AD UPN such as <code>test@domain.com</code>):</p>

<p><img src="https://i.stack.imgur.com/Rd12E.jpg" alt="example certificate with principal name"></p>

<p>I've tried using OpenSSL to generate the client authentication certificate with this command:
<code>openssl req -x509 -config cert_config -extensions 'my server exts' -nodes -days 365 -newkey rsa:4096 -keyout client.key -out client.crt</code></p>

<p>and this cert_config file:</p>

<pre><code>[ req ]
    prompt             = no
    distinguished_name = my dn

[ my dn ]
            commonName = Test
           countryName = US
          localityName = Anywhere
      organizationName = Test
organizationalUnitName = Dev
   stateOrProvinceName = CO
          emailAddress = info@test.com
                  name = Test Cert
               surname = Cert
             givenName = Test
              initials = TC

[ my server exts ]
      extendedKeyUsage = 1.3.6.1.5.5.7.3.2,1.3.6.1.4.1.311.20.2.2
        subjectAltName = otherName:1.3.18.0.2.4.318;UTF8:test@example.com
</code></pre>

<p>But I'm unable to correct format the subject alternative name to match the example in the image above.  I could not find a definition for "NT Principal Name" or "RFC 822 Name" under Subject Alternative Name in the <a href="https://www.openssl.org/docs/man1.1.0/apps/x509v3_config.html" rel="noreferrer">OpenSSL documentation</a>.  When I look at the certificate produced by the command above in keychain access I see:</p>

<p><a href="https://i.stack.imgur.com/0DhFx.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/0DhFx.jpg" alt="produced client certificate"></a></p>

<p>How do I specify the "NT Principal Name" and "RFC 822 Name" fields under Subject Alternative Name in my client authentication certificate?</p>