Meanwhile we have stronger checks for X.509 certificates to comply to RFC 5280,
at least when strict checking is enabled (e.g., using -x509_strict).

Yet unfortunately the OpenSSL apps by default tend to generate certs that are not compliant.
In particular, X.509v3 certs (i.e., those having any X.509 extensions) MUST include

• an authority key identifier (AKID) with the exception of self-signed certs - see https://tools.ietf.org/html/rfc5280#section-4.2.1.1
• a subject key identifier (SKID) with the exception of non-CA certs - see https://tools.ietf.org/html/rfc5280#section-4.2.1.2