I have never used OpenSSL to generate a certificate for a controller. I was watching Jerome's video about the steps needed to do this & he mentioned that the version of OpenSSL that he has used that worked was 0.98k. It was quite difficult to find this version online - it seems to be a few revs old.
--update-- I'd really like to be able to setup a CA on the laptop that is running the VM of ACS & WCS, but the laptop is not a domain member and I'm having difficulties getting the CA and IIS to operate as detailed in MS documentation. I'm guessing it is because the laptop is in a workgroup.--update--
Here is a link to where I downloaded Win32OpenSSL-0_9_8k.exe
You will most likely need to install MS Visual C++ 2008 Redistribuables as well as the SP1.
The direct link to the Cisco documentation that describes the steps needed to generate a certificate on behalf of a controller is here: LINK
You should be familiar with navigating to the Cisco documentation by starting out at the main documentation page: LINK
Jerome's video demonstrating the process is on YouTube in two parts: