It would seem sensible to use the phpseclib libraries to create the certificates

[JonTheNiceGuy]

There is code here: http://phpseclib.sourceforge.net/x509/guide.html#casigned which can be adjusted to match what we'd need. This would reduce the reliance on the ssh commands, as more stuff can be run from the PHP session before offloading the certificate contents.