Missing NULL in x509 RSA certs

[arekinath]

x509 RSA certs should have a NULL after the algorithm OID for backwards compat reasons. The output we're producing is valid but may be unparseable by some ancient certificate parsers -- and also, it means we can produce mismatched output when signing some certificates.

[roccomuso]

+1 thanks