only generate certs if needed