No estoy seguro que sea necesario -new o si haga algo que no deba. Tecnicamente son dos cosas diferentes lo que hacen X509 y new.
Código [Seleccionar]
-new
this option generates a new certificate request. It will prompt the user for the relevant field values. The actual fields prompted for and their maximum and minimum sizes are specified in the
configuration file and any requested extensions.
If the -key option is not used it will generate a new RSA private key using information specified in the configuration file.
-x509
this option outputs a self signed certificate instead of a certificate request. This is typically used to generate a test certificate or a self signed root CA. The extensions added to the certificate
(if any) are specified in the configuration file. Unless specified using the set_serial option 0 will be used for the serial number.