run: simplify cert generation logic