by openssl/dsa_gen.c, as that file is currently written. this might not be what is ultimately desired, but was the quickest way to have a working system again.