certdb: never use the -r option of certutil
    
    The -r option makes certutil output certificates in DER. If there are
    multiple certificates sharing the same nickname, certutil will output
    them concatenated into a single blob. The blob is not a valid DER
    anymore and causes failures further in the code.
    
    Use the -a option instead to output the certificates in PEM and convert
    them to DER on demand.
    
    https://fedorahosted.org/freeipa/ticket/5117
    https://fedorahosted.org/freeipa/ticket/5720
    
    Reviewed-By: David Kupka <dkupka@redhat.com>