====== on-core: certificate renewal ======