Dockerfile: staging cert in