Fix negative serials on generated certs

required for compatibility with Go crypto
You should just be able to call `res.abs()`.