Isn't this better?
Write the certs file (to fix update.cmd) even if it doesn't exist.
Write updater\startssl.pem on Windows. Fixes update.cmd on old installs.