backport a change from git to report X509_REQ_to_X509() failures as CA-rejected-our-request failures
- backport change from git to not choke if X509_REQ_to_X509() fails when we're self-signing using OpenSSL