reorganize cert controllers

Signed-off-by: Stephen Gran <steve@lobefin.net>