install wildcard cert in a place cloudstead can get to it