Fix a bug with private key encryption.

openssl req does not have to generate a private key (which is not encrypted,
even if the user wants to) while key is already generated right before.

shellpki.sh

@@ -71,11 +71,9 @@ fi
 
 # generate csr req
 $OPENSSL req 		\
-    -new -days 1000 	\
-    -config $CONFFILE 	\
-    -newkey rsa:2048 	\
-    -nodes 		\
-    -keyout $DIR/$cn.key \
+    -new            	\
+    -key $DIR/$cn.key   \
+    -config $CONFFILE   \
     -out $DIR/$cn.csr
 
 # ca sign and generate cert