PKI: Issue a Service Certificate

A new internal service needs TLS. Using openssl, generate a 2048-bit (or stronger) private key and a self-signed X.509 certificate for CN=signal9.local, valid for at least 30 more days. Install them where services expect them — the key at /etc/ssl/private/service.key (locked to mode 600) and the certificate at /etc/ssl/certs/service.crt — and make sure the cert actually matches the key (a mismatched pair is the classic outage). Grading inspects the real key/cert with openssl, the way an auditor would. (Maps to NIST SC-12/SC-17 key & certificate management and 800-171 3.13.10.)