extract cert creation to be accessible in handle_sni callbacks