Fixes to SSL certificate generation

Several fixes, including:
 - do not recreate the certificate if it already exists
 - do not change permissions on directories that might be different than
   what we expect (code was assuming it was always
   /etc/<component>/ssl/{certs,private})
 - make private key non-readable by the world