RequestCertificate will either use an existing (if this process has run before but not to completion) or create a certificate signing request using the PEM encoded CSR and send it to API server, then it will watch the object's status, once approved by API server, it will return the API server's issued certificate (pem-encoded).

WaitForCertificate waits for a certificate to be issued until timeout, or returns an error.