do something when we issue a certificate (or fail to)