diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 827a287..4d33d37 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -508,12 +508,16 @@ Continuing with key generation will replace this key."
 
 	# When EASYRSA_EXTRA_EXTS is defined, append it to openssl's [req] section:
 	if [ -n "$EASYRSA_EXTRA_EXTS" ]; then
+		# Setup & insert the extra ext data keyed by a magic line
+		EASYRSA_EXTRA_EXTS="
+req_extensions = req_extra
+[ req_extra ]
+$EASYRSA_EXTRA_EXTS"
 		local awkscript='
 {if ( match($0, "^#%EXTRA_EXTS%") )
 	{ while ( getline<"/dev/stdin" ) {print} next }
  {print}
 }'
-		# This awk inserts the extra ext data keyed by a magic line
 		print "$EASYRSA_EXTRA_EXTS" | \
 			awk "$awkscript" "$EASYRSA_SSL_CONF" \
 			> "$EASYRSA_TEMP_FILE" \
diff --git a/easyrsa3/openssl-1.0.cnf b/easyrsa3/openssl-1.0.cnf
index 5da819a..d9109b5 100644
--- a/easyrsa3/openssl-1.0.cnf
+++ b/easyrsa3/openssl-1.0.cnf
@@ -57,10 +57,8 @@ default_keyfile 	= privkey.pem
 default_md		= $ENV::EASYRSA_DIGEST
 distinguished_name	= $ENV::EASYRSA_DN
 x509_extensions		= easyrsa_ca	# The extentions to add to the self signed cert
-# A section to handle the $EXTRA_EXTS feature
-req_extensions		= req_extra
 
-[ req_extra ]
+# A placeholder to handle the $EXTRA_EXTS feature:
 #%EXTRA_EXTS%	# Do NOT remove or change this line as $EXTRA_EXTS support requires it
 
 ####################################################################