The old version of open ssl 0.9.8h referenced on the cert generation doc doesn't work (if you enter a password in the CSR process).
http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificate...