certificate? I thought i read in docs that they shifted from certificate based to just password based for easy rotation