Tweak TLS certificate generation
Update signatures to SHA256, and move the certificate SANS config onto the node certs.