Update OpenSSL commands on TLS API docs to use best practices

This updates the suggested keysize to provide `openssl` from 1024 to 2048, the current minimum acceptable keysize.

It also adds the `-sha256` flag to the CSR creation command, which will sign the CSR itself with SHA-256 instead of SHA-1. For at least a couple of CAs, this sends a signal to sign the resulting certificate with SHA-256 instead of SHA-1 ([which is now heavily deprecated](https://shaaaaaaaaaaaaa.com).