openssl ca: open the output file as late as possible