If you are generating a self signed cert, you can do both the key and cert in one command like so:

    openssl req  -nodes -new -x509  -keyout server.key -out server.cert

Oh, and what @MadHatter said in [his answer][1] about omitting the `-des3` flag.

  [1]: http://serverfault.com/a/366373