Use tomb for cert changed listener