build certs on first boot (don't use TKL's certs)