[bug] get vpn cert on vpn start

Is not uncommon for the systray to be launched without internet access.
For example in the autostart if the network hasn't come up yet.

Let's fetch the vpn cert when the vpn is starting, instead of in the
initialization of the standalone bitmask. So if the initialization
happens when there is no network the systray doesn't fail to start.

- Resolves: #88