use ingredients style accessors in openssl.cnf template.   Pass in CA key/cert path via ENV vars