work with separate master/agent certs on master

This makes sure the agent's server is the same as the master's certname
and will sign the console/master/database cert in case an agent on those
boxes has a unique cert