Compare the keys in the Tomcat keystore with the Candlepin keystore.

Generally speaking the Tomcat keystore should be a symlink to the
Candlepin keystore, but if it isn't and the keystores are out of sync
users will get strange and cryptic SSL errors.
Quote all paths.
Play nicely with a CA in an /etc/qpid/brokerdb NSS db.

Also use sudo for every certutil command because the command will fail
due to permissions if reading /etc/qpid/brokerdb.