Generate key in a separate call to genrsa, rather combining with the call

to req (csr generation). Not allowed to specify the cipher when via req,
and we want des3. Default changed between FreeBSD 8 and 10, and I have no
idea where to change it, so just do it explicitly on the command line.