slave: don't check for size > 0 when updating certs

The first time through, the certs will be empty and that's ok.

http://wiki.libravatar.org/how_to_add_a_mirror_slave_to_the_mirror_master/
Limit domain names to 60 characters to avoid errors in DNS library

Passing in very long domain names triggered this exception:

  UnicodeError: label empty or too long
Ban SSLv2 and SSLv3 without restricting to TLSv1

If the server supports TLSv1.1 and TLSv1.2 they shouldn't be
disabled by our config.
www: stronger TLS configuration (closes: #1163627)

Turn TLS compression off and prefer better ciphers when they
are available (i.e. not in wheezy).

http://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
Set umask and use absolute paths in gearman workers (closes: #886011)
Bump changelog for deployment