support for different certs for prod vs tag
be consistent about calling it tag not version