Convert OpenSSL certificates that Keystone uses for creating the requests to the nss db format

certs must be prepared before service start

chown all the files

ResellerAdmin role is needed

convert keystone certs only with PKI

node does not have to be keystone: get certificate info from keystone instance
(requires fix in keystone)

create done file for ubuntu only

rewrite converting certificates so the generation does not need
to happen always (patch from vuntz)

set the non-default port, so it can work with Horizon

save listening ports to extra attribute so it is not lost

save port as separate value, save listen_ports_crowbar as hash