This is specifically an independent issue, since the code behaves the same way it did before this PR, explicitly overriding any setting that was provided via the openssl.cnf.  Prior to this PR, the custom openssl.cnf could only be provided by changing system environment variables, and yet if this was done, the extant code would have overridden the key length.

Added #4698 for this independent issue so that the change this PR is meant to address can be folded in before I have to rebase it for the fifth time.