update host.cert with new ssl certs
update host.cert with new ssl certs

We still use the first cert (scl3) in production; we should keep it until we
roll out the new certs. We don't use the second existing cert (mdc1) yet;
let's replace it with a new cert that covers the non-scl3 servers.

- remove old mdc1 cert
- adds new scl3 cert. This will last past Aug30; we can remove it when
it's no longer needed
- adds a new non-scl3 cert. We can keep this one until summer next year.

escapewindow/signingscript,escapewindow/signingscript,escapewindow/signingscript,escapewindow/signingscript,escapewindow/signingscript,escapewindow/signingscript