login-server needs the haproxy certs if using self-signed