The new CertProvider code assumes the certname and hostprivkey/hostcert settings are consistent, but there are cases where hostprivkey/hostcert may be overridden.
It was no longer possible to override the client certificate and corresponding private key using the `hostcert` and `hostprivkey` puppet settings. This fix restores that capability.