rewrite converting certificates so the generation does not need
to happen always (patch from vuntz)