generating certificates finally works more often than it doesn't