The genssl script writes to etc/ssl.pem by default.
There are IPv4 and IPv6 ranges reserved for documentation and example code; use these to minimize the risk if someone accidentally uses an unmodified example conf.