5.6 Create a Certificate Request and Private Key

$ openssl req -nodes -newkey rsa:4096 -keyout samkey.key -out samkey.csr -sha256 -config openssl.cnf

This command does not include the -x509 option, so it will create a Certificate Signing Request (CSR) instead of a self-signed certificate. The command also specifies the -nodes option, which causes the private key to be unencrypted. U-Boot currently does not support password-protected RSA keys.

$ openssl req -nodes -newkey rsa:4096 -keyout samkey.key -out samkey.csr -sha256 -config openssl.cnf
.++
.++

You are about to be asked to enter information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN. 
There are quite a few fields but you can leave some blank
For some fields there will be a default value, 
If you enter '.', the field will be left blank.
Country Name (2 letter code) [US]:
State or Province Name (full name) [Arizona]:
Locality Name (eg, city) [Chandler]:
Organization Name (eg, company) [Microchip Technology]: 
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:U-Boot Image Signing 
Email Address []:
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []:
An optional company name []: