where does `master_certname` come from?