that uses the OpenSSL 1.1 API since using X509_SIG on the stack will no longer be possible. tested/ok sthen (maintainer)