Generate a self-signed cert when none is provided

The documentation suggested doing this manually, but this is better because it does it for you!
This key should be in a folder that in the top level directory, not buried deeply within the roles.