automate cert renewals, made gencrls.sh portable