certs generation is attribute-driven