this should probably just be a top-level function, not redefined as a closure on every call to create_certificates.