turns out that a lot of the director build actuall needs to be done
on-provisioning, particularly creating certificates...
typo