don't output debug messages from hashing new certs

this messages break json output, so keep silent
make handling of self signed certs more robust

openssl sometimes will print the filename, then the error, and finish
with OK, matching the colon and space prevents from considering such
certs to be valid