After over a day of going through their documentation, reading GitHub issues, going through the SDK unit tests and shudder the second page of google results, here's how:
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout id_rsa -out myCert.pem
(id_rsa is your private key, myCert.pem is your CSR)