@thermia rawdog openssl!! but i have a neat helper script now to make the process ridiculously easy for me.
one trip through an article online, another through the openssl manpages to make my weak rsa2048 into strong secp521r1, and i'm very self-sufficient now!