Much more sophisticated cert handling

- Specify per-domain certificates and keys
- Certs are no longer regenerated for SANs
- And more. :)