The list says when a joined relay has no certificate, when this server
couldn't order one and why, and when it runs out, from the certificate
stored here before the one the relay reports (relay spec, RL-27). A
server from before RL-27 sends none of this, and no line shows.
A relay's settings get a Certificate section: how long it's good for or
why the last order failed, and the chain and key to paste where no
domain here manages the public name's DNS. The key is never shown;
left empty, the stored one stays. Clearing the chain removes both.