certs: use 'cmd' to hide openssl output in silent builds more simply