SSL: optional CA and generate keys on install