feat(controller): teach controller about application certificates

supercedes #2570, rebased and all comments addressed.
We should probably capitalize `ssl` everywhere since it's an acronym.