- generate via specific invocation - auto-generate if SSL and no mounted certificate found - allow specifying hostname for certificate