Get the certificate from freeIPA

These commands extracts the host certificate and key and the IPA CA certificate from nssdb. This is required when using ccm-fetch over SSL with a non-kerberos apache webserver. 
the attribute should be called `use_nss` (default `false`) or something like that. ideally, in some future far far away, `CCM` and friends use `NSS`. hmmmmm,  i'm in doubt how to call it, esp if it's part  of ccm schema