Convert OpenSSL certificates that Keystone uses for creating the requests to the nss db format

certs must be prepared before service start

chown all the files

ResellerAdmin role is needed

convert keystone certs only with PKI

node does not have to be keystone: get certificate info from keystone instance
(requires fix in keystone)