The current command generates a key that results in an invalid CSR.

diff --git a/cesnet-tcs b/cesnet-tcs
--- a/cesnet-tcs
+++ b/cesnet-tcs
@@ -193,7 +193,7 @@
 
 	case "$key_alg" in
 		rsa:*) openssl genrsa -out "$outfile" ${key_alg#*:};;
-		*) openssl ecparam -name "$key_alg" -genkey -param_enc explicit -out "$outfile";;
+		*) openssl ecparam -genkey -name "$key_alg" -out "$outfile";;
 	esac
 
 	umask "$orig_umask"