reissue star.wikimedia.org certificate

reissuing the star.wikimedia.org certifcate, full details of reasoning
on RT ticket.

Do not merge this until after the private key is put into private repo,
as rolling it live requires some manual steps of deleting the old
certificate chain and confirming service restarts after implementation.

Change-Id: Ie63c1050b760ca5ad40fdcae31f57923340564c1
RT: 6586