app: generate cert in worker