s2s: cert generation and transfer