Existing certificates are kept but roles with key bits < 2048 will need to be updated as the signing/issuing functions now enforce this.
concatenated PEM file. Fixes #992