Fix negative serials on generated certs

required for compatibility with Go crypto