Can you move the certificate stuff to a separate PR?