Certs a big pain point for ds. DSCTL should offer the nss_ssl wrappers to help administer:

• cert requests
• importing ca / certs
• managing a mini-self signed CA
• issuing user certs (if self signed CA)

We should be enabling a selfsigned cert by default on new installs so that we can use TLS by default in all situations.