Create certificates in the second phase of chef run

Otherwise, the openstack packages are not installed yet, and therefore
the group openstack-<foo> does not exist yet.