Don't fetch certificate on provision. Do that with mcollective