The current generate_cert helper was originally taken from Go's source, and is more complex than we need it to be. This patch replaces it with our own version, rewritten from scratch independently.