support for multiple fingerprints

[[email protected]…]

I will need to periodically rotate the server cert in order to satisfy infosec requirements. Being able to specify multiple cert fingerprints, to be tried in order, should be sufficient.

The envisioned workflow is:

• generate new cert and get its fingerprint (but don't install yet)
• update /etc/bcfg2.conf to have 'fingerprint = <new fingerprint>, <old fingerprint>
• let clients get new config
• put new server cert in place
• let at least another round of clients updates go through
• remove old fingerprint from /etc/bcfg2.conf

If a host is down for longer than the rotation period, they will need to have the fingerprint manually updated when they're back up.

[desai]

All code for this is now merged. Thanks for the patch.