pushed the cert generation in its own function to make it easier to test