move code deailing with generating a new cert into a separate service (away from TES which deals with creating tunnels and running commands)