nginx: make selfsign cert generation more robust

[alxndrsn]

Protect against failure between privkey generation annd fullchain generation.

Noticed while working on #2096.

What has been done to verify that this works as intended?

Demo that privkey.pem can be generated without fullchain.pem generation completing correctly:

#!/bin/bash -eu

log () { echo >&2 "[test] $*"; }

dir="$PWD/tmp-$RANDOM"
mkdir -p "$dir"
cd "$dir"

log "Pre-creating fullchain.pem as read-only..."
touch fullchain.pem
chmod 400 fullchain.pem

log "Generating certs..."
if openssl req -x509 -newkey rsa:4096 \
    -subj "/C=XX/ST=XXXX/L=XXXX/O=XXXX/CN=localhost" \
    -keyout "privkey.pem" \
    -out "fullchain.pem" \
    -days 3650 -nodes -sha256; then
  log "!!!"
  log "!!! Cert generation succeeded, but it should have failed!"
  log "!!!"
  exit 1
else
  log "Cert generation failed."
fi

log "Created files:"
ls -al

log "Bye."

Why is this the best possible solution? Were any other approaches considered?

Seems simple enough? Could regenerate only one key, but that would be a bit more complicated. Or maybe they can be generated separately? Anyway, this is the simplest change I can think of to achieve the goal.

How does this change impact users? Describe intentional behavior changes from code updates. What are the regression risks?

No effect.

Does this change require updates to documentation? If so, please file an issue here and include the link below.

No.