You are making openssl settings configurable via the config file, but private_key_bits can not be overwritten this way. This is not an independent issue.