Be more robust + split out the certificate code