An update for anyone searching for how to do this… the correct command to change the PEM to a RSA key format that dgraph likes:
openssl rsa -in privkey.pem -out tls/ca.key
That made dgraph cert ls happy, but not Chrome. I then tried copying ca.crt to node.crt and ca.key to node.key and voila: Chrome is happy to connect to dgraph via SSL now.