Generate a useful error when we can't download the cert from S3

Right now when you try to download an expired cert, you get an ugly TypeError exception which hides the true cause of the problem.