When propagating the certificate xmpp.nasqueron.org, keytool complains
the certificate already exists. In interactive mode, it would prompt
for overwrite, but this isn't an option offered to provide as argument.
Solution is apparently to remove the old certificate. This is not the
ideal as it will restart the services twice, but that allows automation.