certificate-generator role