fix(etcd): reverse the cert handling

the server tls config needs the client CA information and the client
needs the pub/priv key. This is how this code used to work.