feat(controller): teach controller about application certificates

supercedes #2570, rebased and all comments addressed.
s/preferrable/preferable/