feat(controller): teach controller about application certificates

supercedes #2570, rebased and all comments addressed.