[backend] fix cert generation that was broken by some earlier commit

It used the old private key to generate the cert, instead of the newly
generated one. Before that commit, cert generation was done as a
second step.