If the administrator has not supplied any TLS key+cert configuration,
but has configured kresd to listen on TLS, then generate an ephemeral
key and cert for use while the daemon is running.