Only generate private key and certificate request if ssl enabled.

Only generate private key and certificate request if ssl enabled.

Generating them unconditionally caused a problem with the init script:
the script required there to be a certificate for the private key if
the private key existed, but we do want to allow TCP-only configurations
and always having a private key prevented that.

Also, give the user advice on how to deal with this problem when it
arises in the init script.