Return digests when generating a CSR

shall we add a default to err out?