handle revoked certificates in the reflection api

APNS apps that have had their certificates revoked are hard to identify. This adds a
`:ssl_certificate_revoked` to the reflection api