Detect expiring certs and generate new ones

A new parameter in bcfg2.conf, cert_replace_days, defines the number
of days left before a cert's expiration to regenerate the cert.

True validation should check the entire chain, but this gets us going
again, and puts in the hook needed to perform further checks.