Fix certificate extraction

Moved the cert_from_instance call out of the try..catch, so that it is also used if the request didn't have the certificate in an extension.
Moved the openssl header and footer addition outside of the try..catch.
Moved the \n in the openssl footer to before the text.