Move cert gen after db

It has a rails environment dependency that wants a db present.