refactor and implement op certificates/roles. removed multi-certs