generate relay_clientcerts whitelist from host_vars