Also, looking at the gencert.sh file (https://github.com/frntn/x509-san/blob/686f0468/gencert.sh) we can see it also uses a oneliner with process substitution. (may be unrelevant but that kind of nice too)