We now notice that a TLS certificate on disk has changed, and we
generate a self-signed certificate if none is found.