Improve documentation and possibly implementation on system's TLS certificates

[kheops2713]

Depending on the application used, the way to properly serve the right TLS certificate may vary.

For instance, some applications require the certificate file to only contain the server certificate while for others it is better to have the certificate chain up to the root CA.

In addition, for the XMPP server, the common name (or one SubjectAltName entry) must be the served domain rather than the hostname the server is running on.

So we should probably:

• create a file that has a concatenation of server + root CA cert
• document the use of SubjectAltName to make the cert valid for both host name, domain name and possibly IP address