contrib/shell/kedifa_generateauth: Do not push a self-signed cert if curl status is 60

60 means no CA can validate the provided certificate.
The self-signed certificate we would generate would be no better.
60 means the frontend could serve some certificate, whatever its content,
which means the domain is minimally functional. So do not bother pushing
a self-signed certifiate, and do not signal a failure to the caller.

contrib/shell/kedifa_generateauth

@@ -70,7 +70,10 @@ printf 'CA=%q\nCRL=%q\nURL=%q\n' "$cafile" "$crlfile" "${kedifa_url_base}?auth=$
 echo "done."
 if curl --output /dev/null --silent "https://$domain"; then
   :
-elif [ 35 -eq $? ]; then
+else
+  status="$?"
+  case "$status" in
+  35)
     echo -n "Bootstrapping $domain certificate..."
     tmpdir="$(mktemp --directory --tmpdir "$(basename "$0").XXXXXXXXXX")"
     # Note: this trap is responsible for the final deletion
@@ -91,7 +94,14 @@ elif [ 35 -eq $? ]; then
       "${tmpdir}/bootstrap.key" \
       "${tmpdir}/bootstrap.crt"
     echo " done."
-else
+    ;;
+  60)
+    # There is a cert, but it cannot pass CA check. The one we would probably
+    # be no different, so do nothing & succeed.
+    ;;
+  *)
     echo "Unexpected curl status: $?"
     exit 1
+    ;;
+  esac
 fi