We just discussed this a bit more, we'll likely want to generated example certs in the coobooks (when SSL is selected), so that the admin has a start. He can then later replace the certs manually on the controller node via ssh. This should be the most secure way.