text: newX509Req creates an empty certificate request. You must set
  the following properties to and sign it (see signX509Req) to
  actually use the certificate request.
  makeX509FromReq req cert creates an empty X.509 certificate
  and copies as much data from the request as possible. The resulting
  certificate doesn't have the following data and it isn't signed so
  you must fill them and sign it yourself.
  Example:
  import Data.Time.Clock
  genCert :: X509 -> EvpPKey -> Integer -> Int -> X509Req -> IO X509
  genCert caCert caKey serial days req
  = do cert <- makeX509FromReq req caCert
  now <- getCurrentTime
  setSerialNumber cert serial
  setNotBefore cert $ addUTCTime (-1) now
  setNotAfter cert $ addUTCTime (days * 24 * 60 * 60) now
  signX509 cert caKey Nothing
  return cert