osg-ce-condor.xml select fetch-crl/fetch-crl3 depending if rocks5/rocks6
also script install_ce_cert will install hostcerts if not already installed. This way avoids conflict
with sec_attr variables.