why can't you generate certs like that?