Rewrote certgen because the old code was a mess.