[x509] Adjust for Let's Encrypt

• Mark certificates to automatically request new certs
• Associate to different services
• Mark predecessor for signing?