In general, we prefer to generate certs by running security/tools/generate_cert/main.go
go run main.go -ec-sig-alg ECDSA -ca true
go run main.go -ec-sig-alg ECDSA -san watt -signer-cert ../../pkg/pki/testdata/ec-root-cert.pem -signer-priv ../../pkg/pki/testdata/ec-root-key.pem -mode signer