After running into issues with internal certificates:
in the subsequent process of researching I ended up writing a tool. Because, you know, I will end up having to do it again and the old memory’s not what it used to be - so I put it up on sourceforge.
And, of course, someone else may get some use out of it, too.
I’m not the OpenSSL / certificate / security guru by any means, so please do correct any errors I may have made.