I would suggest this should be an after_save, which then only gets run if the response_set is finished, and there's no existing certificate