split out ->generate_zcert as public method