What is the motivation for using a CA to generate a certificate instead of creating an OpenSSL cert? Reaching into the internals of the CA object means using internal APIs that may break unexpectedly.