example of creating OpenSSL CA and Certificates

Shahaan, I'd love to have your easyrsa stuff in here as well, but I would ask that you remove the geographic information from your certificates and include a role to setup the easyrsa CA.  Infact I'm happy to use easyrsa for a Server CA as well as TLS Web Client CA. Perhaps we will create a generic x509CA role which can either include opensslCA or easyrsaCA?

I don't really care if you generate keys on the CA or on the nodes, but I'd like us to be able to apply the role to CVL or any other cluster without too much customisation.