Challenge - Response protocol - how to incorporate client randomness
Using the same certificate/private key for different purposes should not be allowed whenever possible.
The answer to your question firstly relies on the security of the signature scheme you use. If the signature scheme is unforgeable, then you should be largely fine. Unforgeability means the malicious server who can chosen any messages and get the corresponding signatures but still cannot forge a signature of a message which it has not queried. The server gets only signatures of $H(r_s||r_c)$, but cannot generate other signatures. Then the question is how likely $H(r_s||r_c) =m$ where $m$ is something meaningful and the server wants the signature of it. In this case, unforgeability is not enough because the server simply can reuse the signature without needing to forge one. If $H$ you use is collision resistance and $r_c$ is long enough, then $H(r_s||r_c)$ should be a uniformly random value. It is unlikely $H(r_s||r_c)$ is meaningful and the probability of this case is negligible. 
The order does not matter and MAC is not needed. Note here the message gets signed is $H(r_s||r_c)$ (this hash value will be hashed by the hash function used by the signature scheme), not $r_s||r_c$.