Add missing certificate file to setup script

Also move defaults to options dict instead of modifying sys.argv,
so command line override keeps precedence.