root-certs: move function out of root certs file.