Initialize CERT_DIR lazily instead of on import, but still only once