Since lock_ssl_cert() is a reader lock, there shouldn't be a whole
lot of contention on aquiring it anyway, and we can thundering herd
our way out of it when it clears.