certificates go to directory ./out/ by default

All certificates should be placed in a subdirectory (in case of this branch, this is ./out/). This way you cannot mess with files in e.g. ./tools/ (at least when using the standard settings).