re-enable keystone SSL with stunnel
patch heat client to accept custom CA cert