ensure certificate hash is rebuilt if file content changes