Fix the cert plugin tests
    
    These tests rely on the existence of a backend CA. It is easiest to
    test with a self-signed CA in ~/.ipa so that is what I documented.
    
    These tests are skipped if no CA is available.
    
    Improved robustness a bit by putting the cleanup as a separate test.