tools/cert_create and tools/encrypt_fw set OPENSSL_DIR := /usr, which means if openssl isn't in /usr it's non-trivial to set a different directory, for example in a Yocto cross environment where openssl-native is in the native sysroot.

I can't export OPENSSL_DIR, I can't pass OPENSSL_DIR to make (as it doesn't get passed down to the sub-make). The only solution is to edit the makefile directly.