on-core: certificate renewal: offline