Make CA CLI check that server is offline before generating offline certs

We recently added a flag to the generate command that allows a user to generate a CA client cert offline. We should update this flag to check that the server is not running before generating the certs, to ensure that we can't accidentally wind up with a race condition where the server signs a cert at the same time we do, and a serial number gets lost.

It might be that this work will also enable us to fail more gracefully in general when the server isn't running. We should look for a general-purpose way of improving both these cases.