A little more process:
* cert manager can generate the certificates and send the ack to client.