Find a way to make client cert auth use the actual LetsEncrypt

[michielbdejong]

Looking back at how we made this work, it seems that the client creates a self-signed cert whose hash determines its URL under .box.knilxof.org, but then it serves the LetsEncrypt cert, which will have a different hash altogether. It would be better if we use the hash of the actual LetsEncrypt cert, but the client already needs to edit DNS when only a csr exists, so not sure if/how we can extract the public key hash from the csr. Will have a look at which files letsencrypt.sh produces.

[michielbdejong]

The client cert used for api call is client/scripts/certs/server/my-server.crt.pem, so that's the one that should determine the URL used (through client/scripts/domains.txt) in the Common Name when creating the actual LetsEncrypt cert. It's impossible to know what the hash of the LetsEncrypt cert will be before we generate it (because the CN needs to be inside the cert).