Move certificate generation to after the nginx package is installed

This prevents a problem where the certificate role tries to restart a not yet installed nginx