fix the SSL cert chain for *.planet.wm

the default would have been using the WMF CA

there was still a trusted path but additionally
you got the WMF CA the way install_certificate works
to make the chained.pem

fix "chain issues 'Incomplete, Extra certs, Contains anchor'"

Change-Id: I1f154930e6fd5045b796d7c3029bd5b41e7a0644
Merge "fix the SSL cert chain for *.planet.wm" into production