I gave mocking/stubbing certdirectory.Directory a shot and gave up. The *Directory stuff setting the path as a class variable causing pain again. I'm sure there is a way to mock/stub that, but I can't figure it out. Changing those class init's to use super() helped with the mocking, but there were still cases where I couldn't get it mocked early enough.

Given how uncommon that code path is, even with manual testing, I feel more confident just letting it write to a temp dir, and verifying it' works. I still want to see all the certdirectory using stuff get mocked better though.