TLS: when tls_certificates unset, generate a selfsigned cert