Add a script for generating CA signed certs, and a client cert.

@filbranden @jbeda Take a look.  @derekwaynecarr is there an easy way to get the IP address on a vagrant cluster?
I'd name this something like `external_cert_name` and pass that in.  If it is defined, we should use it, otherwise we can try the metadata server if on GCE.