Add support for generating a CSR

When generating a keypair its fairly likely it'll need to be signed by another
CA. This creates the CSR required for that process if openssl_generate_csr is
true.