Use genrsa to generate key so that we can specify -des3, which

in freebsd10 is not the default.

account/mksyscert.in

 #!/usr/bin/perl -w
 #
-# Copyright (c) 2000-2012 University of Utah and the Flux Group.
+# Copyright (c) 2000-2014 University of Utah and the Flux Group.
 # 
 # {{{EMULAB-LICENSE
 # 
@@ -293,9 +293,15 @@ if( defined( $oldkeyfile ) ) {
     #
     # Create a client side private key and certificate request.
     #
+    my $genopts =
+	($encrypted ? " -passout 'pass:${sh_password}' -des3 " : "");
+
+    system("$OPENSSL genrsa $genopts -out syscert_key.pem 1024")
+	    == 0 or fatal("Could generate new key");
+    
     system("$OPENSSL req -text -new -config syscert.cnf ".
-	   ($encrypted ? " -passout 'pass:${sh_password}' " : " -nodes ") .
-	   " -keyout syscert_key.pem -out syscert_req.pem $outline") == 0
+	   ($encrypted ? " -passin 'pass:${sh_password}' " : "") .
+	   " -key syscert_key.pem -out syscert_req.pem $outline") == 0
 	   or fatal("Could not create certificate request");
 }