More comments and refactor for certs.go
Add -extra-crts