Switch all the selfsigned certificates to be generated on demand

Using the make_cert tool we can generate arbitrary certificate chains on
demand, so they never have to be regenerated.

cc @kellymclaughlin @lordnull