add script to refresh certs

This is a bit of feature creep, but involves practically no new logic and can
be tested trivially and locally.